Data Protection

Data protection guidelines for visitors to our website and other contacts 

Last updated: April 2024

 

1. Introduction

The protection of your personal data is very important to BUWOG Group GmbH (hereinafter “BUWOG”). We therefore process personal data only in accordance with the applicable legislation on the protection of personal data, in particular the General Data Protection Regulation, hereinafter “GDPR” (Datenschutzgrundverordnung, DSGVO). With the following data protection guidelines, we provide you with an overview of how we process your personal data and of your rights under the data protection legislation. These guidelines explain whether BUWOG processes personal data and – if so – the extent to which it does so in connection with the processes mentioned below. As we develop our website and incorporate new technologies to improve our service for you, there may be changes to these guidelines. We therefore recommend that you read this statement again from time to time.

 

2. Contents

1. Introduction
2. Contents
3. Explanation of terms
4. Who is responsible for data processing, and whom may I contact?
5. To whom do these data protection guidelines apply?
6. Which of your sources and data does BUWOG process?
7. What does BUWOG use your data for (purpose of processing) – and on what legal basis?
7.1 On the basis of your consent (Art. 6 (1) lit. a of the GDPR)
7.2 To fulfil contractual or pre-contractual obligations (Art. 6 (1) lit. b of the GDPR) 
7.3 On the basis of a legitimate interest (Art. 6 (1) lit. f of the GDPR)
7.4 On the basis of legal requirements (Art. 6 (1) lit. c of the GDPR)
8. Who receives your data?
9. Is data transferred to a third-party country or to an international organisation?
10. The use of cookies and comparable technologies for processing terminal device information and personal data
11. Social media plug-ins
12. Data security
13. How long is my data stored?
14. What rights to data privacy do I have?
15. Effect of non-communication
16. No automated decision-making

 

3. Explanation of terms

The data protection terms used below are defined in Art. 4 of the GDPR. The full text of the GDPR is available on the internet under the following link: https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32016R0679&from=DE

 

4. Who is responsible for data processing and whom may I contact?

The data controller in accordance with Art. 4 (7) of the GDPR is: 

BUWOG Group GmbH
Rathausstraße 1
A-1010 Wien

The external data protection officer (eDPO) is:

RA Mag. Sascha Jung, LL.M. LL.M.
Jank Weiler Operenyi RAe GmbH | Deloitte Legal
Hohenstaufengasse 9,
A-1010 Wien

BUWOG will be pleased to assist you with any questions concerning the topic of data protection. You can reach us as follows: 

E-Mail BUWOG:    datenschutz@buwog.com
Tel. BUWOG:         +43 (1) 878 28 1000
E-Mail eDSB:         datenschutz-buwog@deloitte.at

 

5. To whom do these data protection guidelines apply?

When we process personal data, it means, briefly summarised, that we collect, store, use, transfer or delete this data.
These data protection guidelines involve personal data pertaining to

  • visitors to our website;
  • visitors to our website who use the communication options available on the website (e.g. the contact form) or take advantage of other services (e.g. our newsletter); 
  • persons who contact us (e.g. via email, fax, post or telephone); and
  • prospective tenants and buyers.

 

6. Which of your sources and data does BUWOG process?

BUWOG processes your personal data when you contact us, e.g. as a visitor to our website, a prospective tenant or buyer, if you write us a message or contact us in some other way, or if you subscribe to our newsletter.

We process the following personal data:

  • Visit to our website

When visiting our website or a project website, we process the following data: technical access data, the name of your internet service provider, the website from which you visit us or the name of the requested file, the date and time of your visit and the data identifying the browser/operating system used as well as your IP address. We evaluate this data – anonymously – for purely statistical purposes and without any reference to your person (e.g. for the evaluation of the number of page views, the duration of use, to defend against attacks on our server, etc.).

The details relating to the use of cookies and tracking tools are described extensively in Section 10 (Use of cookies/comparable technologies) and in the cookie banner at the beginning of your visit to our website (or available at any time under “Cookies” at the bottom of the website). 

  • Communication – contact form

When using our contact form (including for rental applications, requests for priority notice and other property-related inquiries) and thereafter for sending or providing the corresponding information, we process the data and the message you have provided on the respective form.

Only the data which is marked accordingly (or not marked “optional”) is obligatory. All other information is provided voluntarily. Failure to provide voluntary data does, of course, not result in any disadvantages for you. Your IP address and the date and time of the message or order are also stored at the time your message is sent.

  • Communication – newsletter

included) and afterward for sending, we process the data you provide on the respective form.
In addition, your IP address and the date and time of your order are likewise stored at the time of sending.

When you register, we use the double opt-in procedure. This means that we first send you an email to the email address you have provided. In this email, we ask you to confirm that you wish to receive the newsletter. If you do not confirm this within 24 hours, your data is blocked by us and automatically deleted after one month. The purpose of this procedure is to be able to prove your registration and, if necessary, to prevent and clarify any possible misuse of your personal data.

  • Communication - miscellaneous

If you contact us, for instance by telephone, email, fax or post, the content of your inquiry or the message as well as any additional information communicated, such as name, (email) address and the date sent, is processed for the purpose of responding to your inquiry.

  • Form for a rental application or prospective interest

On our website we provide you with a form for prospective tenants to download (PDF). The data you provide (e.g. first name, surname, address) is processed in our internal administration programme for prospective tenants. Additional information is only obtained from you or a third party at a later stage, whereby we only obtain information concerning your financial circumstances (e.g. from KSV 1870) if the conclusion of a tenancy agreement with you depends solely on the positive result of such a credit check.

  • Career portal

As part of your online profile creation and online application, registering for the BUWOG career letter, and joining the talent pool on the BUWOG career portal, we process the data you provide to us there. You can find more information on this in the special data protection guidelines for the BUWOG online job portal, available at https://www.buwog.at/en/data-protection.

 

7. What does BUWOG use your data for (purpose of processing) – and on what legal basis?

BUWOG operates in Austria and Germany. We therefore process the aforementioned personal data in accordance with the provisions of the GDPR, the Austrian Data Protection Act (Datenschutzgesetz, DSG) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Specifically:

7.1 On the basis of your consent (Art. 6 (1) lit. a of the GDPR)

Data processing is legally permissible if you have consented to it for one or more specific purposes. You have the right to revoke this consent at any time without affecting the legal grounds of the processing that has taken place on the basis of your consent until the time of revocation. A revocation of your consent also applies to declarations of consent granted to BUWOG prior to the validity of the GDPR, that is, prior to 25 May 2018. Please note that the revocation only applies with future effect.

  • Visit to our website

The legal basis for processing the data mentioned in Section 6 (Visit to our website) using non-essential cookies (see Section 10) is your voluntary consent through selection of the relevant cookie categories and their confirmation (“Accept all” or “Confirm selection”) via the cookie banner when you visit the website.

We use your data as well as the data of the cookies/comparable technologies so that you can use all of the functions of our website to the full extent, to design and optimise our website on the basis of your needs, to ensure security, as well as for tracking and marketing purposes (see especially Sections 10).

  • Newsletter

You consent is the legal basis for sending the newsletter, with which we inform you of the latest information of interest pertaining to the Austrian BUWOG Group (this includes BUWOG Holding GmbH, FN 212163 f and all of the affiliates in which BUWOG holds a direct or indirect stake of at least 90 percent). You may subscribe to the BUWOG blog for the “Residential” and/or “Career” sections at www.buwog.com (insofar as we refer to newsletters in these data protection guidelines, the BUWOG blog is always included).

We use your data for sending the newsletter.

You may revoke your consent(s) at any time with future effect.

Revocation may take place informally, e.g. by email to datenschutz@buwog.com (for newsletters to  newsletter@buwog.com) or by a message to the contact details provided under Section 4 above. In addition, you may cancel the subscription to the newsletter by clicking on the link provided in a newsletter email.

7.2 To fulfil contractual or pre-contractual obligations (Art. 6 (1) lit. b of the GDPR)

We process your data to fulfil contractual or pre-contractual obligations:

  • Form for prospective tenants

The legal basis for processing your data is Art. 6 (1) lit. b of the GDPR (fulfilment of pre-contractual obligations). The purpose of processing is the preparation of a rental agreement between you and BUWOG or a company affiliated with the Austrian BUWOG Group.

  • Contact form and other contact options

The legal basis for processing your data is Art. 6 (1) lit. b of the GDPR (fulfilment of contractual or pre-contractual obligations) for the purpose of processing and responding to your inquiry and, if necessary, for the specific negotiation and preparation of a rental agreement and/or a property purchase agreement between you and BUWOG or a company affiliated with the Austrian BUWOG Group. In doing so, we use the communication channel you specify (e.g. for sending information brochures).

7.3 On the basis of a legitimate interest (Art. 6 (1) lit. f of the GDPR)

We also process your data on the basis of our legitimate interests or those of third parties:

  • Visit to our website

The legal basis for processing the data mentioned in Section 6 (Visit to our website) using necessary cookies/comparable technologies or our website servers is our legitimate interest in the form of a security guarantee and assurance of the technical functionality of our website.

  • Our messages in connection with your initiation of contact

In addition to the data that you actively provide to us (e.g. email address for the newsletter), BUWOG also processes personal data (e.g. IP address, date and time) that is provided to us in the course of sending messages to contact us (e.g. via our contact form, newsletter, or when applying for a property). Processing is done to prevent misuse and to ensure the security of our information technology systems.

  • Settlement of legal disputes, establishment, exercise and defence of legal claims (e.g. in connection with rights and obligations under the GDPR)
  • The Austrian BUWOG Group

For us to offer you the best possible service and to remain competitive, we also share data within the Austrian BUWOG Group (this includes BUWOG Holding GmbH, FN 212163 f and all of the affiliates in which it holds a direct or indirect stake of at least 90 percent) in order to manage and improve our services.

  • Marketing and direct marketing

We use your data for the purposes of direct marketing (e.g. to conduct customer surveys, opinion polls, marketing campaigns, market analyses, prize draws, competitions or similar promotions and events). In connection with this, we also analyse the results of (direct) marketing activities in order to measure the efficiency and relevance of our actions.

Right to object to processing
In accordance with Art. 21 (1) of the GDPR, you have the right at any time to lodge an objection to the processing of personal data pertaining to you that takes place on the basis of Art. 6 (1) lit. f of the GDPR (data processing for the protection of legitimate interests).

For details on how to exercise this right, see Section 14 below.

7.4 On the basis of legal requirements (Art. 6 (1) lit. c of the GDPR).

BUWOG processes personal data in order to comply with legal obligations on the basis of tax law as well as reporting and information obligations with respect to authorities:

  • Compliance with legal requirements

Legal requirements include e.g. tax and commercial retention obligations and existing requirements for carrying out supervisory measures to prevent white-collar crime or money laundering.

 

8. Who receives your data?

Within BUWOG, only those entities that require your data to fulfil their responsibilities within the Group, exercise the Group’s legitimate interests, and fulfil contractual and legal obligations gain access to your data.

For us to offer you the best possible service and to remain competitive, we share data within the Austrian BUWOG group if it is necessary to safeguard our legitimate interests and if your interests or fundamental rights and freedoms do not outweigh our interests. Whenever this is the case, we guarantee that the transfer of data takes place in accordance with data protection requirements and that your personal data is protected.

We also provide your personal information to the persons/entities listed below for the following purposes:

  • External service providers

BUWOG makes use of the following external service providers to be able to benefit from their particular expertise: (i) agents, (ii) property management companies, (iii) consultants, (iv) service providers, (v) marketing agencies, (vi) IT service providers and (vii) Vonovia SE (HRB 16879, Universitätsstraße 133, D-44803 Bochum).

Insofar as the aforementioned third parties are not themselves responsible in accordance with Art. 4 (7) of the GDPR for processing the data transferred, they shall process your personal data on our behalf in accordance with Art. 28 of the GDPR as so-called processors. Processors only act in accordance with BUWOG’s instructions and are contractually obligated to comply with the applicable data protection requirements with respect to BUWOG.

  • Public authorities

By way of exception, BUWOG provides personal information to courts, regulators, financial authorities and other public authorities as required by law (e.g. in cases of emergency response or criminal prosecution).

 

9. Is data transferred to a third-party country or to an international organisation?

Data is only transferred to countries outside the EU or the EEA (so-called third-party countries) to the extent it is required for the execution of your orders, it is required by law (e.g. tax reporting obligations), or you have given us consent (e.g. cookies/comparable technologies, social media and tracking tools).

 

10. The use of cookies and comparable technologies for processing terminal device information and personal data 

Cookies are small text files that store and/or read a wide range of information on the user’s computer upon access to our website. Cookies cannot execute programmes or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall. Technologies similar to cookies that process terminal device information and personal data can collect a wide range of information when our website is accessed and provide functions similar to cookies without actually using cookies. The cookies/comparable technologies used on our website are categorised as necessary, functional, statistical, marketing, and unclassified. The categorisation and a more detailed description of the respective cookies/comparable technologies was displayed to you when you accessed the BUWOG website. You can access this cookie banner again at any time via the “Cookies” link at the bottom of the website.

Cookies/comparable technologies in the “necessary” category are essential and required for operation of the website. These cookies/comparable technologies are used to correctly display the BUWOG website and thereby ensure user-friendly, effective and secure access. The legal basis for the processing of these cookies is the exception provided for in Art. 174 of the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021, TKG 2021)  as well as our legitimate interest in this regard in accordance with Art. 6 (1) lit. f of the GDPR.

All other cookies/comparable technologies in the categories of marketing, statistics and/or preferences (together “non-essential cookies”) are used to personalise content and advertisements, recognise our website visitors, offer social media functions, record statistical information, pursue marketing purposes with the help of web tracking tools, and be able to target offers more specifically. If you have consented to the use of “unnecessary cookies/comparable technologies” on the BUWOG website via the cookie banner, these “unnecessary cookies/comparable technologies” will be stored or comparable technologies carried out. Unless you have given your consent to the use of “unnecessary cookies” on the BUWOG website, no processing will take place using unnecessary cookies/comparable technologies. If you wish to revoke your consent, you may do so at any time by activating the appropriate setting in the cookie banner, which you can access again via the “Cookies” link at the bottom of the website.

BUWOG uses different cookies/comparable technologies depending on the website visited. This website uses cookies/comparable technologies from the provider specified in the cookie banner when the website is visited. Depending on which BUWOG website you visit, different cookie/comparable technology categories (see previous paragraph) may be displayed.

 

11. Social media plug-ins

Social media plug-ins (“plug-ins”) as well as the social network function “Share via” are used on our website. We also use the map service Google Maps. These services are offered by the companies Facebook, WhatsApp, YouTube, X and Google (“providers”).

  • Facebook

Facebook is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). An overview of the Facebook plug-ins and their appearance can be found here:
https://developers.facebook.com/docs/plugins.

  • WhatsApp

WhatsApp is operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“WhatsApp”). An overview of the WhatsApp plug-ins and their appearance can be found here:
https://www.whatsapp.com/legal/.

  • X (previously Twitter)

X is operated by Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland (“X”).

  • YouTube

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. An overview of the YouTube plug-ins and their appearance can be found here:
https://developers.google.com/youtube/youtube_subscribe_button?hl=de.

  • Google Maps

Google Maps is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Further information about embedding maps from Google Maps can be found here:
https://support.google.com/maps/answer/144361?co=GENIE.Platform%3DDesktop&hl=de
https://support.google.com/maps/answer/144361?co=GENIE.Platform%3DDesktop&hl=de.

Content can be shared via Facebook, X and WhatsApp. Before you click on the corresponding button, no connection to the respective provider is established and no data is shared. To display videos or maps, these services must be activated separately. By clicking on the respective button or activating the respective service, you consent to data processing in this regard. Your browser then establishes a direct connection to the servers of the respective provider. Through the integration of the plug-in, the providers receive the information that your browser has called up the corresponding page of our website, even if you do not have a profile or are not logged in. This information (including your IP address) is transferred by your browser directly to a server of the respective provider and stored there. If you are logged in to one of the services, the providers can directly assign your visit to our website to your profile. Data may also be (further) transferred by the respective provider to third-party countries, such as the USA.

The purpose and scope of collecting the data and its further processing and use by the providers as well as your rights and configuration options for the protection of your privacy can be found in the privacy policies[MS1]  of the respective providers:

The U.S. Foreign Intelligence Surveillance Act (FIS Act) and other U.S. laws require U.S. telecommunications companies and U.S. internet service providers, among others, to provide information to the U.S. authorities without a court order, which makes it possible to monitor users abroad (for instance in the EU). In the USA there is therefore no effective protection of fundamental rights comparable to the European fundamental right to privacy. As U.S. companies, Facebook, Google and YouTube are subject to these legal regulations.

 

12. Data security

The data our customers transfer to us is protected from external interference by firewalls, etc., in accordance with our central system’s state-of-the-art technology.

As soon as you use an input mask, data is transferred between you the user and BUWOG, always via SSL/TSL encryption.

 

13. How long is my data stored? 

BUWOG processes and stores your personal data as long as it is necessary to achieve the purpose for which it is being collected. If the data is no longer necessary to achieve the purpose of its collection, it is deleted unless its – temporary – (further) processing is necessary for the following purposes:

  • Legal retention periods

For compliance with the statutory (commercial and tax) periods for retention and documentation in the Austrian Federal Tax Code (Bundesabgabenordnung, BAO), the Austrian Commercial Code (Unternehmensgesetzbuch, UGB) as well as the German Commercial Code (Handelsgesetzbuch, HGB) and German Fiscal Code (Abgabenordnung, AO), these periods are generally ten years.

  • Evidence

To preserve evidence in the context of the statutory limitation periods:

In accordance with the Austrian Civil Code (Allgemeines Bürgerliches Gesetzbuch, ABGB) and Section 195 ff of the German Civil Code (Bürgerliches Gesetzbuch, BGB), these limitation periods can be up to thirty years, whereby the regular period of limitation is three years.

In addition, the following applies to retention with regard to individual processes:

  • Website visit

Your data is deleted as soon as the respective session has ended. Log files are deleted after seven days. Further storage is possible in exceptional circumstances, but in this case user IP addresses are deleted or encrypted so that an assignment of the accessing client is no longer possible. The amount of time cookie data is to be stored is detailed in the description of the individual cookies/comparable technologies in the cookie banner (accessible at any time under “Cookies” at the bottom of the website).

  • Contact form and other means of communication

In cases of general communication, data from the input masks of the contact forms or other means of communication is deleted when the respective conversation with you ends. The conversation ends when it can be inferred from the circumstances that the matter in question has been ultimately clarified. If communication with you results in a (potential) business relationship (e.g. a rental application) or other necessity, the data is processed further for these purposes. Data relating to applications for a property and requests for priority notice are deleted eight months after the property in question has been rented or sold.

Additional personal data (e.g. IP address) collected during the sending process is deleted at the latest after a period of seven days.

  • Application for a property and request for priority notice

Your data from the data mask to apply for a property and to request a priority notice is deleted eight months after the property has been sold.

Additional personal data (e.g. IP address) collected during the sending process is deleted at the latest after a period of seven days.

  • Newsletter

When you register for our newsletters as a visitor to our website, BUWOG uses the double opt-in procedure. This means that after registering, BUWOG sends you an email to the specified email address in which it asks you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information is blocked and automatically deleted after one month.

We rely on your consent for sending a newsletter until you revoke such consent. After the revocation of your consent we delete your personal data within 14 days. The revocation does not affect the legality of the processing carried out prior to the revocation on the basis of consent.

Additional personal data (e.g. IP address) collected during the sending process is deleted at the latest after a period of seven days.

 

14. What rights to data privacy do I have?

As a data subject, you have the following rights (“rights of the data subject”), you have the following rights in particular if the legal requirements of the GDPR are met:

  • Right of access:

In accordance with Art. 15 of the GDPR, you may request information from us on whether BUWOG processes your personal data and what data this includes.

  • Right to rectification:

If your information is incorrect, you may request a correction in accordance with Art. 16 of the GDPR. If your data is incomplete, you may request its completion. If BUWOG has disclosed your data to third parties, these third parties will be informed of your correction – to the extent this is required by law.

  • Right to restriction of processing:

You have the right to restrict the processing of your data, provided that the requirements of Art. 18 of the GDPR are met.

  • Right to data portability:

If you wish, we will also provide you with your data for further use or transfer it to a recipient you designate.

  • Right to revocation of consent (akin to exercise, see above under Section 7.1) 

If consent has been given to process the personal data, the right to revoke the consent granted at any time with future effect applies, i.e. the revocation does not affect the legality of the processing carried out prior to the revocation on the basis of consent. Following revocation, BUWOG is only permitted to process the personal data to the extent that processing by BUWOG is still necessary on the basis of statutory requirements.

  • Right to object to processing:

In accordance with Art. 21 (1) of the GDPR, you have the right at any time to object to the processing of personal data on the basis of Art. 6 (1) lit f of the GDPR (data processing to safeguard legitimate interests).

If you object, we will no longer process your personal data for the purposes covered by the objection, unless

  • we can demonstrate compelling legitimate reasons that override the interests, rights and freedoms of the data subject, or
  • the processing serves the establishment, exercise or defence of legal claims.

Insofar as the objection is also or only directed against processing data for direct advertising, we will no longer process your personal data for this purpose.

This objection may be made informally, e.g. by email to datenschutz@buwog.com or by a message to the contact details mentioned under Section 4.

  • Right to lodge a complaint:

In addition, there is a right to lodge a complaint with a data protection supervisory authority (Art. 77 of the GDPR in connection with Section 24 of the Austrian Data Protection Act [Datenschutzgesetz, DSG] for Austria and Section 19 of the German Federal Data Protection Act [Bundesdatenschutzgesetz, BDSG] for Germany). However, we recommend that you first direct a complaint to our data protection team. The contact details can be found under Section 4.

 

15. Effect of non-communication

If the aforementioned personal data is not provided, BUWOG cannot collect it. In that case, it is impossible to achieve the specified objectives. For example, it is impossible to consider your application for a particular rental property.

 

16. No automated decision-making

BUWOG does not use fully automated decision-making as defined by Art. 22 of the GDPR to establish and implement a contractual relationship.