Privacy Policy

Introduction

We are delighted that you have taken an interest in our company and our approach to data protection.

In this Privacy Policy, we explain how we handle data protection within our organisation. Here, we aim to inform you about how we collect, use and process your personal data, and how we fulfil our legal obligations towards you in doing so. We also wish to inform you of the rights to which you are entitled under current legislation.

The protection of your data is very important to us, and we are committed to protecting and upholding your data protection rights and to complying with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679) as well as our national laws.

The processing of your personal data always takes place in accordance with the General Data Protection Regulation (hereinafter referred to as the GDPR).

In principle, you can use our websites without providing any personal data.

When processing your enquiry further or when you make use of our services, it may become necessary to process your personal data. If this is necessary and we do not have a legal basis authorising us to do so, we will always seek your consent as the data subject (hereinafter referred to as the ‘data subject’).

In general, we process personal data such as your name, your address and contact details such as your email address or telephone number. Depending on the nature of our business, the processing of further personal data may be necessary. We have documented this in our records of processing activities.

To implement data protection and security (GDPR Art. 34), we have drawn up a data protection policy for our company and implemented it on a risk-based approach, based on data protection impact assessments (GDPR Art. 35), using technical and organisational measures (TOM). In this way, we also safeguard web-based or internet-based data transmission. Nevertheless, this may be compromised by security breaches – for which we are not responsible – so we offer you the option of sending us personal data by other means, such as by telephone, fax or post.

Important: This privacy policy may be amended from time to time.

Data protection terminology

Our Data Protection Policy is based on the terms and their explanations as set out by the European legislators and regulators when the General Data Protection Regulation (GDPR) was adopted. The purpose of our Data Protection Policy is to explain how data protection is implemented within our company in a way that is easy to read and understand for all potential recipients, in particular our customers, suppliers and data subjects. You will find the definitions of terms in the annex to the Data Protection Policy. These have been taken from the text of the legislation and are accompanied by references.

Data controller

The controller within the meaning of Article 24 of the General Data Protection Regulation is:

To this end, we process

• Customers and
• Supplier details
• as well as any data provided by third parties for business processes

which we receive directly from you, which we obtain from other sources, or which we may collect automatically.

How to contact us via our website

The information required by law has been included in the legal notice on our website. This includes the option to send an email or, where applicable, for the data subject to use a contact form.

When data is submitted in this way on a voluntary basis, personal data is automatically stored for the purpose of processing the enquiry or establishing contact. Personal data is not disclosed to third parties.

How we collect data and information

When you visit our website, a range of data and information is collected. We do not use this data to identify specific individuals; rather, it is required in order to:

• to be able to provide and ensure the correct content and functionality of our website,
• to be able to optimise this content,
• where necessary, in the event of attacks on our IT systems, to be able to fulfil our legal obligations in the context of criminal investigations,

When you use our websites, we collect, amongst other things,

• the type of browser used, including the version,
• the operating system used,
• the website and subpages (referrer) from which you accessed our website,
• the date and time of access, as well as the Internet Protocol address (IP address),
• the internet service provider of the accessing system,

as well as other similar data and information intended to protect our IT systems in the event of attacks.

Furthermore, we process personal data provided to us by means other than the internet (e.g. by post) and which we require to fulfil our business purposes. We process this data using both automated and manual procedures.

Our company does not use automated decision-making or profiling..

Legal basis for processing

The legal basis for processing operations where we obtain consent for a specific purpose of processing is Article 6(1)(a) of the GDPR for our company.

Where personal data must be processed to fulfil a contract to which the data subject is a party (e.g. the supply of goods/services or other performance or consideration for which personal data is necessary), the processing is based on Article 6(b) of the GDPR – as is the case for processing operations necessary for pre-contractual measures (e.g. quotes, handling enquiries regarding products or services).

Where our company has a legal obligation (e.g. under tax legislation) which requires the processing of personal data, this is carried out in accordance with Article 6(1)(c) of the GDPR.

The processing of personal data to safeguard the vital interests of the data subject (e.g. in the event of a medical emergency) is carried out by us on the basis of Article 6(1)(d) of the GDPR.

Processing operations that are not covered by any of the aforementioned legal bases, but for which processing is necessary to safeguard a legitimate interest of our company or a third party (provided that the interests, fundamental rights and freedoms of the data subject do not override them) are therefore permitted because they were specifically mentioned by the legislator in Recital 47, second sentence, of the GDPR in conjunction with Article 6(1)(f) of the GDPR

Where the processing of personal data is based on Article 6(1)(f) of the GDPR, our legitimate interest is the pursuit of our business purpose and activities for the benefit of our company.

Deletion and restriction of personal data

The basis for the retention period of personal data is the relevant statutory retention period.

Once the statutory retention period has expired, the relevant data will be deleted or – if this is not possible without disproportionate effort – blocked.

Our company processes and stores the personal data of data subjects only for the period necessary for the purpose of processing, in accordance with the GDPR or any applicable national or international law or regulation that the controller is required to implement.

Rights of the data subject

a.) Transparent information and communication with the data subject

Our company takes appropriate measures to provide the data subject with all information in accordance with Articles 13 and 14 and all communications in accordance with Articles 15 to 22 and Article 34 of the GDPR relating to the processing, in a precise, transparent, intelligible and easily accessible form, using clear and plain language; this applies in particular to information specifically aimed at children.

The information shall be provided in writing or in another form, including electronically where appropriate. If requested by the data subject, the information may be provided orally, provided that the data subject’s identity has been verified by other means.

We shall facilitate the data subject’s exercise of their rights under Articles 15 to 22 of the GDPR.

In the cases referred to in Article 11(2) of the GDPR, we may only refuse to act on the data subject’s request to exercise their rights under Articles 15 to 22 of the GDPR if we can demonstrate that we are unable to identify the data subject.

Our organisation shall provide the data subject with information on the measures taken in response to a request under Articles 15 to 22 of the GDPR without undue delay, and in any event within one month of receiving the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. We shall inform the data subject of any extension of the time limit within one month of receiving the request, together with the reasons for the delay. If the data subject submits the request electronically, we shall, where possible, reply to the data subject by electronic means.

Should we not have acted on the data subject’s request, we will inform the data subject without delay, but at the latest within one month of receiving the request, of the reasons for this and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.

We will provide information in accordance with Articles 13 and 14 of the GDPR, as well as all communications and measures in accordance with Articles 15 to 22 and Article 34 of the GDPR, free of charge.

In the case of requests from a data subject that are manifestly unfounded or – particularly in the event of frequent repetition – excessive, we may either

• charge a reasonable fee, taking into account the administrative costs of providing the information, issuing the notification or carrying out the requested action, or
• we may refuse to act on the request.

To this end, we will be required to provide evidence that the request is manifestly unfounded or excessive.

If we have reasonable doubts as to the identity of the natural person making the request in accordance with Articles 15 to 21 of the GDPR, we will, without prejudice to Article 11 of the GDPR, request additional information necessary to confirm the identity of the data subject.

The information to be provided to data subjects in accordance with Articles 13 and 14 of the GDPR may be provided in combination with standardised pictograms in order to convey a meaningful overview of the intended processing in a form that is easily perceptible, understandable and clearly comprehensible. Where the pictograms are presented in electronic form, we shall make them available in a machine-readable format (Article 12(1) of the GDPR).

b.) Duty to provide information when collecting personal data from the data subject

Where our company collects personal data from the data subject, we shall inform the data subject of the following at the time of collection:

• the name and contact details of the data controller and, where applicable, their representative,
• where applicable, the contact details of the data protection officer,
• the purposes for which the personal data are to be processed, and the legal basis for the processing,
• where the processing is based on Article 6(1)(f) of the GDPR, the legitimate interests pursued by the controller or by a third party,
• where applicable, the recipients or categories of recipients of the personal data; and
• where applicable, our company’s intention to transfer the personal data to a third country or an international organisation, as well as the existence or absence of an adequacy decision by the Commission or, in the case of transfers pursuant to Article 46, Article 47 or the second subparagraph of Article 49(1) of the GDPR, a reference to the appropriate or suitable safeguards and how a copy of them may be obtained or where they are available.

In addition to the information referred to in paragraph 1, we provide the data subject, at the time of collection of this data, with the following further information, which is necessary to ensure fair and transparent processing:

• the period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
• the existence of a right to obtain from the controller information regarding the personal data in question, as well as the right to rectification, erasure, restriction of processing, the right to object to processing, and the right to data portability;
• where the processing is based on Article 6(1)(a) or Article 9(2)(a) of the GDPR, the existence of a right to withdraw consent at any time, without this affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal;
• the existence of a right to lodge a complaint with a supervisory authority;
• whether the provision of personal data is required by law or under a contract, or is necessary for the conclusion of a contract; whether the data subject is obliged to provide the personal data; and what the possible consequences of failure to provide such data would be; and
• the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for the data subject.

If we intend to further process the personal data for a purpose other than that for which it was collected, we shall provide the data subject, prior to such further processing, with information regarding that other purpose and all other relevant information in accordance with paragraph 2.

Paragraphs 1, 2 and 3 shall not apply if and to the extent that the data subject already has the information (Article 13(1) of the GDPR).

c.) Obligation to provide information where personal data has not been collected from the data subject

Where personal data has not been collected from the data subject, our company shall inform the data subject of the following:

• the name and contact details of the data controller and, where applicable, their representative;
• in addition, the contact details of the data protection officer;
• the purposes for which the personal data are to be processed, and the legal basis for the processing;
• the categories of personal data being processed;
• where applicable, the recipients or categories of recipients of the personal data;
• where applicable, the controller’s intention to transfer the personal data to a recipient in a third country or to an international organisation, as well as the existence or absence of an adequacy decision by the Commission or, in the case of transfers pursuant to Article 46, Article 47 or the second subparagraph of Article 49(1) of the GDPR, a reference to the appropriate or suitable safeguards and the possibility of obtaining a copy of them or where they are available.

In addition to the information referred to in paragraph 1, we provide the data subject with the following information, which is necessary to ensure that the data subject is treated fairly and transparently:

•  the period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
•  where the processing is based on Article 6(1)(f) of the GDPR, the legitimate interests pursued by the controller or by a third party;
•  the existence of a right to obtain from the controller information regarding the personal data concerned, as well as the right to rectification, erasure or restriction of processing, the right to object to processing, and the right to data portability;
•  where the processing is based on Article 6(1)(a) or Article 9(2)(a) of the GDPR, the existence of a right to withdraw consent at any time, without this affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal;
•  the right to lodge a complaint with a supervisory authority;
•  the source from which the personal data originates and, where applicable, whether it originates from publicly available sources;
•  the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for the data subject.

Our company provides the information in accordance with paragraphs 1 and 2

•  taking into account the specific circumstances of the processing of the personal data, within a reasonable period of time after the personal data has been obtained, but no later than one month,
•  if the personal data is to be used to communicate with the data subject, at the latest at the time of the first communication to them, or,
•  if disclosure to another recipient is intended, at the latest at the time of the first disclosure.

If our company intends to further process personal data for a purpose other than that for which the personal data was obtained, we shall provide the data subject, prior to such further processing, with information regarding that other purpose and all other relevant information in accordance with paragraph 2.

Paragraphs 1 to 4 shall not apply if and to the extent that

• the data subject already has the information;
• providing this information proves impossible or would involve a disproportionate effort; this applies in particular to processing for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes, subject to the conditions and safeguards set out in Article 89(1) of the -GDPR, or where the obligation referred to in paragraph 1 of this Section is likely to render impossible or seriously impair the achievement of the purposes of such processing. In such cases, the controller shall take appropriate measures to safeguard the rights and freedoms and the legitimate interests of the data subject, including making that information available to the public,
• the collection or disclosure is expressly provided for by Union or Member State law to which the controller is subject and which provides for appropriate measures to safeguard the data subject’s legitimate interests; or
• the personal data is subject to professional secrecy, including a statutory duty of confidentiality, under Union law or the law of the Member States, and must therefore be treated as confidential (Article 14(1) of the GDPR).

d) Right to confirmation

Every data subject has the right to request confirmation from the controller as to whether personal data concerning them is being processed. If this is the case, the data subject has the right to access (Article 15(1) of the GDPR)

e) Right of access

Where personal data relating to the data subject is being processed, the data subject has the right to access that personal data and to receive the following information (Article 15(1) of the GDPR)

• the purposes of the processing,
• the categories of personal data being processed,
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular where recipients are in third countries or are international organisations,
• where possible, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period,
• the existence of a right to rectification or erasure of personal data concerning them, or to restriction of processing by the controller, or a right to object to such processing,
• the existence of a right to lodge a complaint with a supervisory authority,
• where the personal data are not collected from the data subject: any available information as to the source of the data,
• the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and — at least in such cases — meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for the data subject.

Where personal data is transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 in connection with the transfer (Article 15(2) of the GDPR).

We shall provide a copy of the personal data being processed. For any further copies requested by the data subject, we will charge a reasonable fee based on the administrative costs involved. Where the request is made electronically, we will provide the information in a commonly used electronic format, unless otherwise specified in the request (Article 15(3) of the GDPR)

f) Right to rectification

The data subject has the right to obtain from the controller the rectification without undue delay of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed – including by means of providing a supplementary statement (Article 16 of the GDPR).

g) Right to erasure (right to be forgotten)

The data subject has the right to request that the controller erase personal data concerning them without undue delay, and the controller is obliged to erase personal data without undue delay if any of the following grounds apply:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
• The data subject withdraws their consent on which the processing was based in accordance with Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing,
• The data subject objects to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR,
• The personal data has been unlawfully processed,
• The erasure of the personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject,
• The personal data was collected in relation to information society services offered in accordance with Article 8(1) of the GDPR.

Where our organisation has made the personal data public and we are obliged to erase it in accordance with paragraph 1, we shall take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform the controllers processing the personal data that a data subject has requested the erasure of all links to that personal data, or of copies or replicas of that personal data. (Art. 17 GDPR).

h) Right to restriction of processing

The data subject has the right to request from the controller the restriction of processing where one of the following conditions is met:

The data subject disputes the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data,

• whether the processing is unlawful and the data subject objects to the erasure of the personal data and instead requests the restriction of the use of the personal data,
• whether the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it to establish, exercise or defend legal claims, or,
• whether the data subject has objected to the processing pursuant to Article 21(1), as long as it has not yet been established whether the controller’s legitimate grounds override those of the data subject,

Where processing has been restricted in accordance with paragraph 1, such personal data – apart from its storage – may only be processed with the data subject’s consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of an important public interest of the European Union or of a Member State.

A data subject who has obtained a restriction on processing in accordance with paragraph 1 shall be informed by the controller before the restriction is lifted. (Art. 18 GDPR).

i.) Obligation to notify in connection with the rectification or erasure of personal data or the restriction of processing

As the controller, we shall notify all recipients to whom personal data have been disclosed of any rectification or erasure of the personal data or any restriction on processing pursuant to Article 16, Article 17(1) and Article 18 of the GDPR, unless this proves impossible or involves a disproportionate effort. We shall inform the data subject of these recipients if the data subject so requests (Article 19 of the GDPR).

j) Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to our company, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller without hindrance from the controller to whom the personal data was provided, provided that

• the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b) of the GDPR, and,
• the processing is carried out by automated means,

When exercising their right to data portability in accordance with paragraph 1, the data subject has the right to have the personal data transmitted directly from our company to another controller, insofar as this is technically feasible.

The exercise of the right under paragraph 1 of this Article is without prejudice to Article 17 of the GDPR. This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The right under paragraph 1 must not infringe upon the rights and freedoms of others (Article 20 of the GDPR).

k) Right to object

The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on those provisions.

In the event of an objection, our company will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims,

Where we process personal data for the purposes of direct marketing, the data subject has the right to object at any time to the processing of their personal data for the purposes of such marketing. This also applies to profiling insofar as it is related to such direct marketing.

If the data subject objects to us processing their personal data for the purposes of direct marketing, we will no longer process the personal data for that purpose;

We will expressly inform the data subject of the right referred to in paragraphs 1 and 2 at the latest at the time of our first communication with them; we will provide this information in a comprehensible form and separately from any other information.

In connection with the use of information society services, the data subject may, notwithstanding Directive 2002/58/EC, exercise their right to object by means of automated procedures using technical specifications,

Furthermore, the data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them carried out by our organisation for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, - unless - such processing is necessary for the performance of a task carried out in the public interest (Article 21 of the GDPR).

l) Automated individual decision-making, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning them or similarly significantly affects them.

Paragraph 1 shall not apply if the decision

• a) is necessary for the conclusion or performance of a contract between the data subject and the controller,
• b) is authorised by Union or Member State law to which the controller is subject, and that law provides for appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject; or
• c) is based on the data subject’s explicit consent,

In the cases referred to in paragraph 2(a) and (c), we shall take appropriate measures to safeguard the rights and freedoms and the legitimate interests of the data subject, including, at a minimum, the right to request that the controller involve a person, to state their point of view and to challenge the decision.

Decisions pursuant to paragraph 2 must not be based on special categories of personal data as referred to in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to safeguard the rights and freedoms and the legitimate interests of the data subject (Article 22 of the GDPR).

m) Right to withdraw consent to the processing of personal data

The data subject has the right to withdraw consent to the processing of personal data at any time.

Any data subject may exercise these rights. To do so, they should contact either:

- our Data Protection Officer at the email address:
dsb-wts@wts-vbw.de

or

- to our Data Protection Officer at the following address:

DeWAG Wohnen GmbH & Co. KG, Data Protection Officer, Kleiner Schloßplatz 13, 70173 Stuttgart

Disclosure of personal data

We may and must disclose your personal data, where necessary and in accordance with local laws and regulations, in a variety of ways and for a variety of purposes to the following recipients:

• Tax, audit or other authorities, where we believe in good faith that we are obliged by law or under any other regulation to disclose this data (for example, in response to a request from a tax authority or in connection with an anticipated legal dispute),
• Healthcare institutions such as health insurance funds,
• external service providers who perform services on our behalf (including external consultants, business partners and professional advisers such as lawyers, auditors and accountants, technical support functions and IT consultants who carry out development and testing work on our company’s technological systems),
• providers of outsourced IT services and storage providers, provided that a data processing agreement (or comparable safeguard) is in place,

Where data processing on behalf of a client is involved, this is based on a data processing agreement within the meaning of Chapter 4 of the GDPR.

Disclosure of personal data for statutory or contractual reasons

The provision of your personal data is required by law (e.g. under tax laws and regulations) or on the basis of contractual provisions (e.g. details of the contracting party or subcontractor).

It may be necessary for the data subject to provide us with personal data in order to fulfil the contract. This therefore forms the basis for our performance of the contract. If the data subject fails to provide the personal data, the contract cannot be concluded.

In the event of any uncertainty, the data subject may contact the Data Protection Officer, who can explain whether the obligation is statutory or contractual and what impact the failure to provide the personal data would have on the conclusion of the contract.

Appendix I: Our contact details

Country in which we use services provided by companies or provide services to companies: Federal Republic of Germany

The company responsible for processing the personal data of visitors to our website www.dewag.de: DeWAG Wohnen GmbH & Co. KG

The company responsible for processing the personal data of data subjects, customers, suppliers and our company’s employees:

DeWAG Wohnen GmbH & Co. KG, Kleiner Schloßplatz 13, 70173 Stuttgart

How to contact us:

• to access, amend or withdraw the personal data you have provided to us,
• if you suspect that your personal data has been misused, lost or accessed without authorisation,
• to withdraw your consent to the processing of your personal data (where consent forms the legal basis for the processing of your personal data),
• if you have any comments or suggestions regarding this privacy policy.

Postal address:

DeWAG Wohnen GmbH & Co. KG, Datenschutzbeauftragter, Kleiner Schloßplatz 13, 70173 Stuttgart

Alternatively, you can contact our Data Protection Officer as follows:

External Data Protection Officer appointed via

WTS Wohnungswirtschaftliche Treuhand Stuttgart GmbH

Hohe Str. 16, 70174 Stuttgart

Telephone: 049711/16 34 54 10

dsb-wts@wts-vbw.de

Here’s how to contact us if you’d like to update your advertising preferences:

Send us an email at: info@dewag.de

Appendix II – Contact details of the relevant local supervisory authority

Country in which we use services provided by companies or provide services to companies: Federal Republic of Germany

Contact details of the relevant local supervisory authority:

For our company, which is based in Stuttgart in the federal state of Baden-Württemberg:

The State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg.

• Post: Postfach 10 29 32, 70025 Stuttgart

• Email: poststelle@lfdi.bwl.de

• Telephone: (+49) 0711/61 55 41 – 10

• Fax: 0711/61 55 41 – 15

Annex III – Country-specific features of the Data Protection Directive

Legal system: Federal Republic of Germany

Country-specific legal provisions:

Requests to delete your data

If your data is not processed automatically, we are not obliged to erase your data – provided that your data is not being processed unlawfully – if erasure would be impossible due to the storage method used or would require a disproportionate amount of effort, provided that we consider your interest in erasure to be minimal.

If your data is processed automatically, we are also entitled to refuse to delete your data if we have reason to believe that deletion would conflict with your legitimate interests, or if deletion would cause us to breach legal obligations to retain your data for a specific period. Instead, in such circumstances, the processing of your data will be restricted in the manner provided for in the GDPR.

Employee data

The provisions governing employment relationships permit the processing of employees’ personal data for purposes related to the employment relationship where this is necessary for recruitment decisions or, following recruitment, for the performance or termination of the employment contract, or to comply with and fulfil the rights and obligations of employee representatives as provided for by law or by collective agreements or other contracts between the employer and a trade union. Further information can be found in Section 26 of the new Federal Data Protection Act.

In Germany, we collect data on employees’ membership of a religious community in order to facilitate our employee remuneration processes. As this is required by law, we do not ask our employees for their explicit consent to the processing of this information.

Appendix IV – Definition of data protection

Our Privacy Policy uses the following terms, amongst others::

a) ‘personal data’ and ‘data subject’

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’). A natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 4(1) of the GDPR).

A data subject is any identified or identifiable natural person whose personal data is processed by the controller,

c) ‘processing’

Processing means any operation or set of operations which is carried out on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction (Article 4(2) of the GDPR),

d) ‘restriction of processing’

Restriction of processing means the marking of stored personal data with the aim of limiting their future processing (Article 4(3) of the GDPR),

e) ‘Profiling’

Profiling means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements of that natural person (Article 4(4) of the GDPR),

f) “Pseudonymisation”

Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person (Article 4(5) of the GDPR),

g) ‘File system’

A file system is any structured collection of personal data which is accessible according to specific criteria, whether that collection is centralised, decentralised or organised according to functional or geographical criteria (Article 4(6) of the GDPR),

h) ‘controller’ or ‘data controller’

The controller or data controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be laid down by Union law or the law of the Member States (Article 4(7) of the GDPR),

i) ‘Data processor’

A data processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller (Article 4(8) of the GDPR),

j) ‘Recipient’

A recipient is a natural or legal person, public authority, agency or other body to whom personal data are disclosed, irrespective of whether they are a third party or not. However, public authorities which may receive personal data in the course of a specific investigation mandate under Union law or the law of the Member States shall not be regarded as recipients (Article 4(9) of the GDPR),

k) ‘third party’

A third party is a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons authorised to process the personal data under the direct responsibility of the controller or the processor (Article 4(10) of the GDPR),

l) ‘Consent’

Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action, by which the data subject signifies agreement to the processing of personal data relating to them (Article 4(11) of the GDPR),

(m) ‘personal data breach’

A personal data breach is defined as a breach of security leading to the destruction, loss or alteration, whether accidental or unlawful, or to the unauthorised disclosure of or unauthorised access to personal data that has been transmitted, stored or otherwise processed (Article 4(12) of the GDPR),

n) ‘genetic data’

Genetic data means personal data relating to the inherited or acquired genetic characteristics of a natural person which provide unique information about the physiology or health of that natural person and which have been obtained, in particular, from the analysis of a biological sample from the natural person concerned (Article 4(13) of the GDPR),

o) ‘biometric data’

Biometric data means personal data relating to the physical, physiological or behavioural characteristics of a natural person, obtained by specific technical means, which enable or confirm the unambiguous identification of that natural person, such as facial images or dactyloscopic data (Article 4(14) of the GDPR),

p) ‘health data’

Health data means personal data relating to the physical or mental health of a natural person, including the provision of healthcare services, and from which information about their state of health can be derived (Article 4(15) of the GDPR),

q) ‘main establishment’

1. In the case of a controller with establishments in more than one Member State, ‘main establishment’ means the place of its central administration in the European Union, unless the decisions regarding the purposes and means of the processing of personal data are taken in another establishment of the controller in the European Union and that establishment is authorised to have those decisions implemented; in which case the establishment that takes such decisions shall be deemed to be the main establishment;

2. in the case of a data processor with establishments in more than one Member State, means the place of its central administration in the Union or, where the data processor has no central administration in the Union, the establishment of the data processor within the European Union where the processing operations carried out in the context of the activities of an establishment of the data processor mainly take place, in so far as the data processor is subject to specific obligations under this Regulation (Article 4(16) of the GDPR),

r) ‘representative’

A representative is a natural or legal person established in the European Union who has been designated in writing by the controller or processor in accordance with Article 27 of the GDPR and who represents the controller or processor in relation to their respective obligations under this Regulation (Article 4(17) of the GDPR),

s) ‘undertaking’

An undertaking is a natural or legal person engaged in an economic activity, regardless of its legal form, including partnerships or associations which regularly engage in an economic activity (Article 4(18) of the GDPR),

t) ‘group of undertakings’

A group of undertakings means a group consisting of a controlling undertaking and the undertakings controlled by it (Article 4(19) of the GDPR),

t) ‘binding corporate rules’

Measures for the protection of personal data to which a controller or processor established in the territory of a Member State undertakes to comply with regard to transfers, or a category of transfers, of personal data to a controller or processor within the same group of undertakings or the same group of undertakings carrying out a joint economic activity in one or more third countries (Article 4(20) of the GDPR),

u) ‘supervisory authority’

A supervisory authority is an independent public body established by a Member State in accordance with Article 51 of the GDPR (Article 4(21) of the GDPR),

v) ‘supervisory authority concerned’

A supervisory authority concerned is a supervisory authority affected by the processing of personal data because:

1. the controller or processor is established in the territory of the Member State of that supervisory authority;

2. such processing has, or is likely to have, a substantial impact on data subjects residing in the Member State of that supervisory authority; or

3. a complaint has been lodged with that supervisory authority (Article 4(22) of the GDPR),

w) ‘cross-border processing’

Cross-border processing means either:

1. the processing of personal data carried out in more than one Member State in the course of the activities of establishments of a controller or a processor in the European Union, where the controller or processor is established in more than one Member State, or

2. the processing of personal data carried out in the context of the activities of a single establishment of a controller or a processor within the European Union, which has or is likely to have a significant impact on data subjects in more than one Member State (Article 4(23) of the GDPR),

x) ‘substantive and justified objection’

A substantial and reasoned objection is understood to mean an objection concerning whether or not there has been a breach of the GDPR or whether the intended measure against the controller or processor is in accordance with the GDPR, whereby this objection clearly sets out the scope of the risks posed by the draft decision in relation to the fundamental rights and freedoms of data subjects and, where applicable, the free movement of personal data within the European Union (Article 4(24) of the GDPR),

y) ‘information society service’

An information society service constitutes a service within the meaning of Article 1(1)(b) of Directive (EU) 2015/1535 of the European Parliament and of the Council (Article 4(25) of the GDPR);

z) ‘international organisation’

An international organisation is an organisation governed by public international law and its subordinate bodies, or any other body established by or on the basis of an agreement concluded between two or more countries (Article 4(26) of the GDPR)

INFORMATION ABOUT COOKIES

DeWAG Wohnen GmbH & Co. KG (hereinafter referred to as ‘DeWAG’) would like to thank you for your interest in our website and our company. Despite careful and regular monitoring of content, we cannot accept any liability for external links to third-party content.

The protection of your personal data during its collection, processing and use in connection with your visit to our website is of great importance to us, and we want you to feel secure when visiting our website. We naturally comply with the legal provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), the Telemedia Act (TMG) and other data protection regulations.

We would therefore like to take this opportunity to inform you about the use of cookies on our website.

What is a cookie?

• A ‘cookie’ is a piece of information stored on your computer’s hard drive that tracks your browsing activity on a website. This enables us to offer you personalised options based on the information stored from your last visit. Cookies may also be used to analyse traffic and for advertising and marketing purposes.
• Cookies are used by almost all websites and do not harm your system. If you wish to check or change which types of cookies are accepted, you can usually do so in your browser settings.

What types of cookies are there, and how do we use them?

• Essential cookies
  These cookies are strictly necessary to guide you through the website or to allow you to access certain features.
• Functionality cookies
  These cookies improve a website’s functionality by storing your settings.
• Performance cookies
  These cookies help to improve the website’s performance and provide a better user experience.
• Cookies used to manage web statistics
  Cookies are also used, for example, to identify the frequency of use and repeat visits to websites. This type of cookie is not used on the DeWAG Wohnen GmbH & Co. KG website..
• Online advertising behaviour cookies
  These cookies are used to personalise the adverts shown to each visitor. This type of cookie is not used on the DeWAG Wohnen GmbH & Co. KG website..

Personal data

• You do not need to provide any personal data to use our website.

Cookie settings

• You can prevent cookies from being stored by adjusting your browser settings accordingly; however, please note that, in this case, you may not be able to make full use of all the features of this website. For details on how to change your browser settings, please refer to the instructions provided by your browser manufacturer.
• Further information on how cookies work is available, amongst other sources, from the Federal Office for Information Security: https://www.bsi-fuer-buerger.de

Integration of third-party services and content

We use the OpenStreetMap (OSM) mapping service. We integrate OpenStreetMap map data hosted on the server of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The United Kingdom is considered a safe third country for data protection purposes. This means that the United Kingdom has a level of data protection equivalent to that in the European Union. When you use OpenStreetMap maps, a connection is established with the OpenStreetMap Foundation’s servers.

In doing so, your IP address and other information about your behaviour on this website may be forwarded to the OSMF. OpenStreetMap may, for this purpose, store cookies in your browser or use similar recognition technologies.

The use of OpenStreetMap is in the interest of presenting our online services in an appealing manner and ensuring that the locations we specify on the website can be easily found. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent may be withdrawn at any time.

Google Analytics 4

Provided you have given your consent, this website uses Google Analytics, a web analytics service provided by Google LLC. The data controller in the EU is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin 4, Ireland (“Google”).

Scope of processing

Google Analytics uses cookies that enable us to analyse your use of our websites. The information collected via these cookies about your use of this website is usually transferred to a Google server in the USA and stored there.

We use the User ID feature. The User ID enables us to assign a unique, persistent ID to one or more sessions (and the activities within those sessions) and to analyse user behaviour across devices.

We use Google Signals. This allows Google Analytics to collect additional information about users who have enabled personalised adverts (interests and demographic data), and adverts can be served to these users in cross-device remarketing campaigns.

In Google Analytics 4, IP address anonymisation is enabled by default. As a result of IP anonymisation, your IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

During your visit to the website, your user behaviour is recorded in the form of ‘events’. Events may include:

• First visit to the website
• Start of the session
• Webpages visited
• Your ‘click path’, interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links
• Internal search queries
• Interaction with videos
• File downloads
• Adverts viewed / clicked on
• Language setting

The following information is also recorded:

• Your approximate location (region)
• Date and time of your visit
• Your IP address (in truncated form)
• Technical information about your browser and the devices you use (e.g. language settings, screen resolution)
• Your internet service provider
• The referrer URL (the website or advertising material via which you arrived at this website)

Purposes of processing

On behalf of the operator of this website, Google will use this information to analyse your (pseudonymous) use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website and the success of our marketing campaigns.

Recipient

The recipient of the data is

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland

as a data processor. To this end, we have entered into a data processing agreement with Google. Google LLC, based in California, USA, and, where applicable, US authorities may access the data stored by Google.

Transfer to third countries

It cannot be ruled out that data may be transferred to the USA. The European Commission adopted its adequacy decision for the USA on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. As Google’s servers are located worldwide and a transfer to third countries (such as Singapore) cannot be entirely ruled out, we have also entered into the EU Standard Contractual Clauses with the provider.

Retention period

The data we send, which is linked to cookies, is automatically deleted after 14 months. The maximum lifespan of Google Analytics cookies is 2 years. Data that has reached the end of its retention period is automatically deleted once a month.

Legal basis

The legal basis for this data processing is your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR and Section 25(1), first sentence of the TTDSG.

Withdrawal

You may withdraw your consent at any time with future effect by accessing the cookie settings and changing your selection there. You can access the cookie settings via the fingerprint embedded at the bottom of the page. This does not affect the lawfulness of any processing carried out on the basis of your consent up until the time of withdrawal.

You can also prevent cookies from being stored in the first place by adjusting your browser settings accordingly. However, if you configure your browser to reject all cookies, this may result in restricted functionality on this and other websites. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by:

a. not giving your consent to the setting of the cookie, or

b. Download and install the browser add-on to disable Google Analytics HERE.

Further information on the Google Analytics Terms of Service and Google’s privacy policy can be found at https://marketingplatform.google.com/about/analytics/terms/de/ and at https://policies.google.com/?hl=de.

Google-Tag-Manager

We use Google Tag Manager from Google. “Google” is a group of companies comprising Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; and other affiliates of Google LLC.

We have entered into a data processing agreement with Google. Google Tag Manager is a support service and only processes personal data itself for technically necessary purposes. The tool ensures that other components are loaded, which may in turn collect data. Google Tag Manager does not access this data. Where relevant consent has been obtained, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

Further information on Google Tag Manager can be found in Google’s privacy policy.

Please note that, under US law, US intelligence agencies may be able to access personal data which is inevitably exchanged with Google via the Internet Protocol when this tool is integrated.

Cookie Consent Manager CCM19

We use the CCM19 consent management tool on our website. This technology is provided by Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn (hereinafter “CCM19”).

The purpose of the tool is to obtain and document the necessary consents for data processing, thereby ensuring compliance with legal obligations. Data processing is therefore carried out to fulfil a legal obligation on the basis of Article 6(1)(c) of the GDPR.

CCM19 stores a cookie in your browser to enable it to associate the consents you have given – or their withdrawal – with your account. To this end, a connection is established with CCM19’s servers. This data is not passed on to any other third parties.

We have entered into a data processing agreement (DPA) for the use of the service. This is a contract required under data protection law, which ensures that the personal data of our website visitors is processed only in accordance with our instructions and in compliance with the GDPR.

LinkedIn Ads and LinkedIn Insight Tag

On our website, we use the advertising services of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, as well as the associated conversion tracking tool ‘LinkedIn Insight Tag’.

Data is processed for the purposes of statistical analysis of website usage, measuring the performance of our LinkedIn adverts, and serving interest-based adverts on LinkedIn. In particular, information about your visit to our website may be collected, such as pages viewed, referrer URL, IP address, device and browser characteristics, and timestamps.

LinkedIn may also process the collected data for its own purposes and may link it to information from your LinkedIn account, provided you are registered with and logged into LinkedIn. We receive only aggregated and anonymised reports from LinkedIn and no personal data relating to individual users.

The use of LinkedIn Ads and the LinkedIn Insight Tag is based solely on your consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. Consent is obtained via our consent management tool and may be withdrawn there at any time with future effect.

The transfer of personal data to companies within the LinkedIn Group in third countries, in particular the USA, cannot be ruled out. Where necessary, the transfer of data takes place on the basis of an adequacy decision by the European Commission or appropriate safeguards in accordance with Article 46 of the GDPR, in particular the European Commission’s Standard Contractual Clauses.

Further information on the processing of personal data by LinkedIn can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

Social Media

We maintain publicly accessible profiles on social media platforms. You can find a list of the specific social media platforms we use below.

Our social media presence is intended to ensure the most comprehensive online presence possible. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR.

The analysis processes initiated by the social media platforms may be based on different legal grounds, which must be specified by the operators of the social media platforms (e.g. consent within the meaning of Article 6(1)(a) of the GDPR).

When you visit one of our social media pages, we are jointly responsible with the operator of the social media platform for the data processing operations triggered by that visit. You may, in principle, exercise your rights (right of access, rectification, erasure, restriction of processing, data portability and the right to lodge a complaint) both against us and against the operator of the relevant social media platform (e.g. Facebook).

Please note that, despite our joint responsibility with the social media platform operators, we do not have full control over the data processing operations carried out by the social media platforms. Our options depend largely on the corporate policy of the respective provider.

Data collected directly by us via our social media presence is deleted from our systems as soon as the purpose for its storage no longer applies, you request its deletion, you withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions – in particular retention periods – remain unaffected.

We have no influence over the use and retention period of your data stored by the operators of social networks for their own purposes. For further details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

LinkedIn

Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Irland

Privacy Policy: https://www.linkedin.com/legal/privacy-policy

Instagram

Service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland)

Privacy Policy: https://help.instagram.com/519522125107875

Xing

Service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Deutschland)

Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung