Privacy Information

The following data processing activities are represented on this website:

• Operation of the website including the use of cookies and online fonts
• Reach measurement
• Prospective tenants and existing tenants
• Applicant management
• Clients and business partners
• Your rights

2.1. Operation of the Website

The controller of data processing is:

BÖAG Immobilien Management GmbH & Co. KG
Schauenburgerstraße 27
20095 Hamburg
Phone: +49 (0) 40 - 36 97 28 11
Fax: +49 (0) 40 – 36 97 28 10
Email: info@boeag-immo.de

Further information about the controller can be found in the legal notice (Impressum).

The controller receives all inquiries regarding data protection.

Our website is hosted by Host Europe GmbH, c/o WeWork, Friesenplatz 4, 50672 Cologne. The following information, which your browser automatically transmits to the server, is processed there:

• Name and URL of the retrieved file
• Date and time of access
• Amount of data transferred
• Notification of successful retrieval
• Type and version of browser
• Operating system
• The website you visited before
• Websites that are accessed by the user's system through our website
• Internet service provider of the user
• IP address and the requesting provider

If you have enabled the JavaScript function in your browser, additional information from your browser can be read with each page call, such as:

• Screen resolution, e.g., 1680 x 1050
• Color depth (e.g., 24 Bit)
• Size of the browser window (e.g., 1680 x 917)

To optimally display the fonts on the website, online fonts from the server of Monotype Imaging Holdings, Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA (fonts.com) are loaded. When accessing a page, your browser loads the necessary fonts into your browser cache to correctly display texts and fonts. This allows the provider to know that our website was accessed via your IP address, along with some technical information about your browser, as nearly every web browser automatically sends this data to the server with each call. Although the provider needs the transmitted information, especially the IP address, only to deliver the requested content, it is beyond our knowledge and influence whether and to what extent the provider also statistically evaluates or stores this information.

In addition, the service provider utilizes the service of Cloudflare, Inc., 101 Townsend St, San Francisco, California 94107-1934, USA, to enhance the security of our website. Cloudflare is a content delivery network that implements DDoS protection, a web firewall, and a reverse proxy to block threats and limit abusive bots and crawlers. By accessing our website, the data transmitted from your end device to our website is forwarded to Cloudflare.

Our web presence uses cookies to offer you a comfortable and feature-rich online service and to verify your authorization to use the service offering. Furthermore, it is stored whether you have consented to certain processing activities.

A cookie is information that is stored on your end device (computer, smartphone, tablet, etc.) depending on the browser used, for example, in the form of a text file or in a database. This information can be read again by our web server when you navigate on our website or visit it again.

The cookies on the website contain personal data. Cookies save you from having to enter data multiple times, facilitate the transmission of specific content, and help us identify particularly popular areas of our internet presence. Thus, they enable us to continuously improve the structure and content of our web presence. The following cookies are processed on your end device

a. FluentLocal
Type: Technically necessary
Function: This cookie stores your preferred language display.
Storage duration: 4 months

b. cf_bm
Type: Technically necessary
Function: This cookie is set by the CDN provider from our font provider and is a necessary cookie for bot protection. Learn more about Cloudflare cookies.
Storage duration: 30 minutes

The processing of your personal data is carried out in accordance with Art. 6 Para. 1 S. 1 lit. f) GDPR in conjunction with §25 Para. 2 S. 2 of the Act on the Regulation of Data Protection and the Protection of Privacy in Telecommunications and Telemedia (TTDSG) for the following purposes:

• Enabling the use of our website
• Ensuring the proper operation of our website
• Fulfilling legal obligations, i.e., network and information security

A data processing agreement has been concluded with our service providers in accordance with Art. 28 GDPR.

For reasons of data security, i.e., to investigate unauthorized access or prevent misuse of the website, the complete IP address of the requesting computer is captured, stored, and automatically deleted 7 days after the end of access.

The transfer of personal data to a third country is based on the adequacy decision between the EU and the USA for the service providers:

• Cloudflare, Inc.
• Monotype Imaging Inc.

Further information can be found in the service provider's privacy information:

• Privacy information at Monotype Inc.
• Privacy information at Cloudflare Inc.

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Therefore, there is no option for the user to delete, object to, or correct this data.

By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, the website will not be displayed optimally, and you will not be able to fully use all the functions of the website.

2.2. Reach Measurement

On our website, we use the privacy-friendly web analytics software Matomo (www.matomo.org). The software is hosted by the processor Schaper Software, Bandelstr. 28, 30171 Hannover, with whom a data processing agreement has been concluded.

From the data transmitted to us by your browser, a usage profile is created under a pseudonym, which enables us to recognize your internet browser. The data collected using Matomo technology (including your anonymized IP address) are transmitted to us and stored for the purpose of usage analysis.

Through the statistical evaluation of the collected data, we are able to compile information about the use of our website and thus continuously improve its structure and user-friendliness. This purpose also constitutes our legitimate interest in processing the data according to Art. 6 Para. 1 S. 1 lit. f) GDPR. Your IP address is anonymized immediately after processing and before storage.The necessity for processing personal data exists because the software used is suitable for optimizing our web offer without transferring your data to third parties for other purposes. In our assessment, it is foreseeable for you as a user that we measure the reach of our website, for example, to design the offer according to needs. For this purpose, ongoing recognition, continuously extensive profile building, and the transfer of data to third parties are not necessary.

The statistical data we generate provide us with sufficient insight into the general usage behavior, making it unnecessary to maintain individual usage profiles for the purpose of reach measurement. Thus, the impact on our visitors is considered minimal. We store all web-tracking data collected via Matomo indefinitely because this data is available to us only in anonymized form.

The Do-not-track function was activated during setup. If your browser is set accordingly, data processing will not be carried out.

You have the option to object to the processing of your personal data in our reach measurement (Opt-Out). This will protect your privacy but will also prevent us from learning from your browsing behavior and improving the usability of our website for users.

Your data will be automatically deleted after 90 days. Aggregated data will be deleted after 12 months.

2.3. Prospective Tenants and Existing Tenants

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is:

BÖAG Immobilien Management GmbH & Co. KG
Schauenburgerstraße 27
20095 Hamburg
Phone: +49 (0) 40 - 36 97 28 11
Fax: +49 (0) 40 - 36 97 28 10
Email: info@boeag-immo.de

If you have any questions about data protection, please contact our data protection officer in writing at the following address:

By mail: Keyword "Data Protection Officer" at the above address or

By email to: datenschutz@boeag-immo.de

The processing of personal data is carried out in accordance with Art. 6 Para. 1 S. 1 lit. b) GDPR primarily for the purpose of:

• Initiating contracts, i.e., processing your personal data for planning and conducting viewing appointments, using prospective tenant documents, suitability checks, and the decision on concluding and drafting the rental agreement including the acceptance or rejection of the application.
• Implementation and termination of rental agreements as well as all services related to the operation and management of rental properties. This includes, among other things:

• Correspondence with external sales partners in the context of renting.
• Receipt of all information and documents from the owner.
• Acceptance and management of tenants' security deposits.
• Viewing of rental properties, contract negotiations, and execution of contract conclusions and handover of the rented premises.
• Preparation of the rental property, e.g., creating signs for the mailbox, intercom, and apartment door.
• Addressing tenant issues and concerns as part of tenant support.
• Monitoring of the rented premises, adherence to house rules, and handling of house rules matters, such as inquiries, complaints, and obligations.
• Preparation and evaluation of reports on outstanding items and contract master data.
• Ordering necessary maintenance and repair work on rental properties and on technical facilities (e.g., elevators, heating, water supply and wastewater, house electricity, security technology, etc.) through external service providers and tradespeople.
• Creation of operating and heating and other ancillary cost statements and prepayments.
• Monitoring of rent payments, review and implementation of rent increases.
• Requirements concerning the management of rental contracts and rental securities / condominium owners' association (WEG) management by the property management (e.g., account opening at banks and financial institutions, management and deposit of cash flows, processing of direct debit withdrawals).
• Handling of declarations of intent that lead to the termination of the rental relationship, for example.
• Return of the rented premises upon termination of the rental relationship.
• Exercising the landlord's lien, return of securities, such as the settlement of deposits.
• Handling of all verbal and written communication with prospective tenants and tenants.

The processing of personal data takes place in accordance with legal requirements as per Art. 6 Para. 1 S. 1 lit. c) GDPR. This includes, among others:

• Retention obligations according to the German Fiscal Code and the German Commercial Code
• § 19 Para. 3 of the German Federal Registration Act (registration obligations)
• § 6b of the Regulation on Heating Costs Billing – HeizkostenV
• § 556 Para. 1 BGB in conjunction with the Operating Costs Ordinance BetrKV

The processing of personal data takes place according to the legitimate interest of us or third parties as per Art. 6 Para. 1 S. 1 lit. f) GDPR. This includes, among others:

• Fulfillment of the proof obligations of legal requirements
• Management of tenant files by the owner
• Out-of-court and judicial assertion of any claims of the owner, dunning process or pursuit of warranty claims
• Communication about important matters with the owner
• Defense, implementation, or assertion of possibly existing legal claims by us or by third parties, such as the property owner
• Ensuring IT security and IT operations
• Measures for the further development of services and products
• Business management and risk management
• Establishment, implementation, and processing of contracts for property management, such as:

• Consulting services regarding the necessity and appropriateness of contracts, solicitation of offers, and conclusion of contracts for e.g., construction measures, janitorial services, insurance, maintenance contracts for technical devices, snow removal and gritting services, energy services (e.g., electricity, water, gas), disposal, maintenance and repair (e.g., construction workers, architects)
• Monitoring and proper execution of contracts, i.e., random checks, invoice verification, acceptance, handling of defects, and traffic safety obligations
• Termination of contracts and execution of settlements
• Issuance of declarations of intent in coordination with the owner
• Handling all correspondence with authorities and contractual partners of the owner
• Financial and asset management
• Setting up and managing accounting
• Budget management, accounting, reporting, and payment transactions
• Technical management
• Proper maintenance and repair of the properties, i.e.,
• Monitoring the structural and technical condition
• Advising the owner on the necessity of measures
• Obtaining cost estimates and offers
• Supervising the work including acceptance and defect management
• Implementation of immediate measures in urgent cases
• Damage reports
• Organization and monitoring in the area of traffic safety
• Random monitoring of proper use of the property including carrying out of cosmetic repairs
• Implementation of structural changes
• Management of access controls (locking system)
• Initiating inspections and maintenance of safety devices by service providers and experts
• Participation in the processing of insurance claims, such as damage assessment and elimination

We generally process personal data that we have received directly from you during the contract initiation phase and throughout the contractual relationship. If you previously made contact through a real estate agent or a real estate portal, we have received your data from these third parties.

Data is usually generated from the following sources:

• Transmission of information and documents by current property managers or owners
• Written correspondence with you (email, postal, fax, etc.)
• Self-disclosures provided by you
• Creation of handwritten notes in the presence of the data subject or during telephone calls

During the application process, the following categories of data are processed:

• Personal master data (e.g., first name, surname, age, address, profession, data on employment relationship, job center, student, BAföG, average income, tenants moving in and their relationship to the applicant, desired lease start date, pets, signature)
• Communication data (e.g., telephone number, email address)
• Rental property (e.g., address, floor, total rent, deposit, brokerage, administrator, living space, number of rooms, total rent, move-in date, special requests)
• Other data according to self-disclosure (e.g., existence of home and liability insurance, knowledge of the energy certificate, remarks)
• Viewing appointments and dates, written correspondence, notes, correspondence

During the execution and termination of the contract, additional categories of data are processed, such as:

• Banking and creditworthiness data (e.g., account numbers and financial institutions, credit report, salary statements),
• Legitimation and authentication data (copies of identity cards, residence permits, letters from authorities confirming rent payments, signatures)
• Data for maintenance/repairs
• Planning and conducting viewing appointments for subsequent tenants
• Consumption data and operating costs according to BetrKV and HeizKV
• Correspondence during the tenancy

The stored data is collected within the scope of our contractual relationship as well as individual orders, or it arises in the context of business relationships and business initiation. The processing of the data is carried out for the fulfillment and execution of the orders placed with us, as well as for commercial and tax law documentation and archiving obligations.

The data is provided to the following recipients for specific purposes:

• Public entities that receive data due to legal regulations (e.g., social security agencies, authorities) and in the context of state-subsidized housing to auditors/tax advisors and city/municipal administrations.
• Internal departments involved in the execution of the respective business processes.
• External parties, insofar as they are necessary for the fulfillment of the contract, such as:

• Craftsmen, technicians, service providers, or experts
• Building insurers and liability insurers

• External processors in accordance with Art. 28 GDPR for processing the data on our behalf, such as:

• Metering service providers
• IT service providers for the operation of IT systems as well as maintenance and support

• Other external parties, such as guarantor banks, affiliated companies, or other external parties for the fulfillment of the purposes mentioned above, such as collection agencies or legal advisors
• Furthermore, data is passed on to commissioned companies for which you have given us consent, which are necessary for the fulfillment of the contract or are legally required, or transmission is permissible due to a predominantly legitimate interest of us or third parties.

Your data is generally processed within the EU. If we intend to process your data in a third country, we ensure that the recipients have appropriate guarantees in accordance with Art. 44 et seq. GDPR to ensure an adequate level of data protection. Possible guarantees include an adequate level of protection determined by the EU Commission, such as in Switzerland or Canada, your consent to data processing, or standard contractual clauses concluded with the recipient. For further information, please contact our data protection officer.

Data is stored in accordance with Art. 17 GDPR for as long as necessary for the purposes for which the personal data were collected, unless conflicting legal obligations, such as retention requirements under the Money Laundering Act (5 years), Commercial Code (6 years), Tax Law (10 years), or Broker and Developer Ordinance (5 years), apply.

Upon the cessation of the purpose, data is deleted through standardized processes within the company. In individual cases, the storage period may be extended if there are indications that claims by you, us, or third parties exist and are asserted. The storage then continues for as long as processing your data is necessary for the assertion, exercise, and defense of legal claims. According to §§ 195 ff of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereas the regular limitation period is 3 years.

Within the scope of our business relationship, those personal data must be provided that are necessary for the initiation and execution of a business relationship and the fulfillment of the associated contractual obligations or for the collection of which we are legally obliged. Without this data, we are unable to conclude or perform a contract.

2.4. Applicant Management

The responsible entity in the sense of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is the BOEAG Group company to which you are applying for employment.

If you have any questions about data protection, please contact the respective company or submit your inquiry to:

BÖAG Real Estate Management GmbH & Co. KG
Schauenburgerstraße 27
20095 Hamburg
Phone: +49 (0) 40 - 36 97 28 11
Fax: +49 (0) 40 – 36 97 28 10
Email: info@boeag-immo.de

Further information can be found in the legal notice (Impressum).

We process personal data that we receive directly from you or through an application portal as part of your application. This includes:

• Personal master data (such as title, first name, surname, address)
• Communication data (such as email address and telephone number)
• Application data (such as cover letter, curriculum vitae, attachments, certificates, and possibly other information provided by you) as well as information arising from the job interviews.

We process your personal data for the initiation and, if applicable, establishment of an employment relationship in accordance with Art. 6 Para. 1 S. 1 lit. b) GDPR.

The processing of personal data may also occur based on further labor law, tax law, financial, or social law provisions. Insofar as processing of personal data is necessary to fulfill a legal obligation to which we are subject, it is carried out on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR.

The processing of voluntarily provided health data according to Art. 9 Para. 1 GDPR is required so that rights arising from Part 3 of the Ninth Book of the Social Code can be exercised and the related obligations can be fulfilled. The processing of this data is based on Art. 9 Para. 2 lit. b) GDPR in conjunction with § 26 Para. 3 BDSG (Federal Data Protection Act).

There may be circumstances where your personal data is used for the assertion, exercise, and defense of legal claims if you or we have or assert legal claims. The legal basis would then be Art. 6 Para. 1 S. 1 lit. f) GDPR. According to this, the processing of personal data is lawful if the processing is necessary to protect our legitimate interests or the interests of third parties, unless your interests and rights in excluding processing prevail.

Within the company, access to your data is granted to individuals necessary for planning and co-determination in establishing a contractual relationship.

Your application data may be shared within the entire corporate group, as far as legally permissible. Furthermore, processors according to Art. 28 GDPR are employed who are responsible for the operation and maintenance of our network, the devices used, and applications.

Information may only be shared if legal provisions require it, you have consented in advance, processors commissioned by us guarantee compliance with the GDPR, or our legitimate interest, e.g., fulfillment or for the defense or assertion of legal claims, outweighs your interests, rights, and freedoms.

Your data is generally processed within the EU. If we process your data in a third country, we ensure that the recipients have appropriate guarantees according to Art. 44 ff. GDPR to ensure an adequate level of data protection. Possible guarantees include an adequate level of protection determined by the EU Commission, such as in Switzerland or Canada, your consent to data processing, or standard contractual clauses concluded with the recipient. For further information, please contact the address mentioned above.

Your personal data processed for the decision on the establishment of a contractual relationship will generally be deleted when the processing is no longer necessary for the decision regarding the establishment of a contractual relationship. The duration of storage thus depends on the duration of the decision-making process and the related actions.

Your data will be stored for 6 months after the decision on the establishment of a contractual relationship and will be deleted after this period if a contractual relationship does not come into being. Any written application you have submitted will be returned to you after the expiry of this period.

In individual cases, the storage period may extend beyond the decision on the establishment of the intended contractual relationship. This would be the case, for example, if there are indications that you will assert claims against us. The storage then continues for as long as processing your data is necessary for the assertion, exercise, or defense of legal claims. Criteria for the storage duration may include periods according to laws such as § 15 Paragraph 4 Sentence 1 of the General Equal Treatment Act, § 61b of the Labor Court Act, limitation periods, or statutory retention obligations for tax documents.

Storage may also occur if provided for or required by the European or national legislator in EU regulations, laws, or other provisions to which we are subject. The provision of your health data is voluntary. Without the provision of health data, your rights under Part 3 of the Ninth Book of the Social Code cannot be exercised, and the responsible party cannot fulfill the related obligations.

Within the framework of the employment relationship, you must provide those personal data necessary for the commencement, execution, and termination of the employment relationship and the fulfillment of the associated contractual obligations. Without this data, we will generally not be able to conclude or execute the employment contract with you.

2.5. Clients and business partners

The responsible party in terms of the General Data Protection Regulation and other national data protection laws of the Member States and other data protection regulations is the company within the BOEAG group with which you are seeking or conducting contract negotiations. If you have any questions regarding data protection, please contact the respective company or submit your inquiry to:

BÖAG Immobilien Management GmbH & Co. KG Schauenburgerstraße 27 20095 Hamburg Telephone +49 (0) 40 - 36 97 28 11 Fax +49 (0) 40 - 36 97 28 10 Email: info@boeag-immo.de Further information can be found in the imprint.

We process personal data that we have received from you or your employer in the course of our business relationship. Additionally, we process personal data obtained from other companies or third parties, if necessary for the provision of our services, in accordance with applicable regulations (e.g., for the execution of orders, fulfillment of contracts, or based on your consent).

In accordance with legal requirements, we may process data that has been publicly disclosed by you. The main categories of data include:

• Personal master data
• Communication data
• Company data
• Invoice data
• Authentication data
• Offer, order, and contract data
• Correspondence and notes
• Protocol and metadata from electronic or telephone communication.

The processing of personal data is carried out in accordance with Article 6(1)(b) of the GDPR primarily for the purpose of initiating contracts and implementing contracts concluded or for pre-contractual measures with our customers and business partners, as well as all services associated therewith.

Additionally, as a company, we are subject to legal obligations pursuant to Article 6(1)(c) of the GDPR, such as those outlined in the Commercial Code, the Tax Code, or the Money Laundering Act.

The processing of personal data is additionally carried out in accordance with the legitimate interests of us or third parties, as per Article 6(1)(f) of the GDPR. This includes, among others:

• Processing of contact data and history for unified and coordinated corporate communication with yo
• Fulfillment of proof obligations under legal requirements, such as the General Data Protection Regulation
• Ensuring IT security and IT operations
• Direct marketing measures, such as Christmas cards, invitations to events, or birthday greetings to existing customers and business partners within the scope of §7 UWG (Act Against Unfair Competition)
• Measures for the further development of services and products
• Measures for business and risk management within the corporate group, such as prevention of money laundering and terrorist financing
• Assertion, exercise, or defense of possible legal claims by us or third parties

The data is transmitted purposefully to the following recipients:

• Internal employees within the corporate group for the purposeful implementation of the above-mentioned purposes
• Public authorities receiving data due to legal regulations (e.g., social security agencies, authorities), as well as in the context of state-subsidized housing to auditors/accountants, and municipal administrations and notaries
• External processors (service companies) for the processing of data on our behalf in accordance with Art. 28 GDPR Other external entities such as affiliated companies or other external entities to fulfill the aforementioned purposes, provided you have given your written consent, it is necessary for the fulfillment of the contract, is legally required, or transmission is permissible due to overriding legitimate interests of us or third parties, such as legal advisors, auditors, assessors, auditors, or investors.

Your data is generally processed within the EU. If we intend to process your data in a third country, we ensure that the recipients have appropriate guarantees according to Art. 44ff GDPR to ensure an adequate level of data protection. Possible guarantees include an adequacy decision by the EU Commission, such as in Switzerland or Canada, your consent to data processing, or EU standard contractual clauses concluded with the recipient. For further information, please contact the responsible party using the contact details provided above.

The data is stored, supplemented, and updated in accordance with Article 17 GDPR for as long as necessary for the respective purpose for which the personal data are processed, unless there are conflicting legal obligations, such as retention obligations under the Administrative Offenses Act (3 years), Money Laundering Act (5 years), Commercial Code (6 years), or Tax Code (10 years).

If this purpose ceases to exist, the data is deleted through standardized processes within the company. In individual cases, the storage period may be extended if there are indications that claims by you, us, or third parties exist and need to be asserted. The storage then continues for as long as the processing of your data is necessary for the assertion, exercise, or defense of legal claims. According to §§ 195 ff of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being 3 years

Within the framework of the legal requirements of the GDPR, you have the following rights:

• Art. 15 GDPR (Right of access by the data subject): You have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data.
• Art. 16 GDPR (Right to rectification): If your data is incorrect or incomplete, you have the right to obtain rectification of inaccurate personal data or completion of incomplete personal data.
• Art. 17 GDPR (Right to erasure): You have the right to request the erasure of your personal data. Your right to erasure depends, among other things, on whether the data concerning you is still necessary for us to fulfill our legal obligations.
• Art. 18 GDPR (Right to restriction of processing): You have the right to request the restriction of processing of your personal data.
• Art. 21 GDPR (Right to object): You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you.
• Art. 7 (3) GDPR (Right to withdraw consent): You have the right to withdraw your consent to the processing of your personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• Art. 77 GDPR (Right to lodge a complaint with a supervisory authority): You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Hamburg Commissioner for Data Protection and Freedom of Information (www.datenschutz-hamburg.de).
• There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

Due to the ongoing development of our website or the implementation of new technologies, it may be necessary to amend this information for future effect. We recommend that you review the most current information available.