Data Protection

Data Protection Guidelines for Potential Customers and Visitors to Our Website

1. Introduction

Our Data Protection Guidelines can be found here, last updated on 29 February 2024.

In these Data Protection Guidelines we inform you of how and in what scope we process your personal data and about your rights in accordance with the General Data Protection Regulation (“GDPR”).

As we develop our services and our website and incorporate new technologies to improve our services for you, there may be changes to these Data Protection Guidelines. We therefore recommend that you reread these Guidelines from time to time.

2. Explanation of terms

The data protection-related terms used below (e.g. “personal data”, “controller”, “data protection officer” or “data processing”) are defined in Art. 4 of the GDPR. The full text of the GDPR is available on the internet under the following link:

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN

3. Who is responsible for data processing and who can I contact?

3.1. Data controller in accordance with Art. 4 (7) of the GDPR

In these Data Protection Guidelines, we refer to the respective responsible company or responsible companies from the BUWOG Group as “BUWOG”. We explain who this is in each individual case below:

The entity responsible for data processing in connection with use of the www.buwog.de website is:

BUWOG Bauträger GmbH
Rankestraße 21
10789 Berlin
Telephone: +49 30 33 85 39 1900
office-bautraeger@buwog.com

The respective buyer or seller (i.e. the project company acquiring or selling the property) together with BUWOG Bauträger GmbH is responsible for the data processing in connection with the planning, implementation and handling of construction projects as well as the purchase and sale of properties or land. The joint controllers have agreed that BUWOG Bauträger GmbH shall be responsible for fulfilling the rights of the data subjects and serve as the point of contact. However, this does not preclude you from contacting the respective project company as another joint controller.

The project company named in the legal notice of the project website is responsible for the data processing in connection with the use of an individual planning project website (“project website”).

Unless otherwise stated, Buwog Bauträger GmbH is responsible for the data processing in connection with the organisation of events and visits to our offices.

The respective BUWOG company to which you apply is responsible for the data processing in connection with your application for employment.

3.2. Contact information for the data protection officer

BUWOG will be pleased to assist you with any questions concerning the issue of data protection. You may reach our data protection officer, as follows:

Dr. Stefan Drewes
c/o Vonovia SE
Universitätsstraße 133
44784 Bochum
E-Mail: datenschutz@vonovia.de

Our data protection officer is the data protection officer of Vonovia Group, to which BUWOG also belongs. We expressly point out that when using this email address, the contents are not noted exclusively by our data protection officer. If you wish to exchange confidential information, we therefore ask that you first contact us directly via this email address without providing a more detailed description of the matter.

4. To whom do these Data Protection Guidelines apply?

Briefly summarised, when we process personal data, it means that we collect, store, use, transfer and delete this data.

These Data Protection Guidelines involve personal data pertaining to:

  • Visitors who browse our website or a project website (when using the website and the communication options available on it, such as the contact form)
  • Users who make use of our other services (e.g. our newsletter)
  • Prospective sellers and buyers as well as sellers and buyers, including their employees, tenants and business partners
  • Employees of business partners and service providers (e.g. in connection with the development or sale of a property)
  • Visitors to our office premises
  • Participants in our events
  • Applicants for employment with BUWOG
5. Which of your data does BUWOG process, and from which sources does it originate?

We process your personal data when you contact us, e.g. as a visitor to our website, as a prospective buyer or seller, when you write us a message or as a subscriber to our newsletter. We also process your personal data if we have received it from a third party (e.g. a real estate agent).

We process the following personal data: 

Website visit

When visiting our website or a project website, we process the following data: technical access data, the name of your internet service provider, the website from which you visit us or the name of the requested file, the date and time of your visit and the data identifying the browser/operating system used as well as your IP address. We evaluate this data – anonymously – for purely statistical purposes and without any reference to your person, e.g. for the evaluation of the number of page views and the duration of use.

The details in connection with the use of cookies and tracking tools are described in Section 9 (Cookie use) and the use of plug-ins in Section 10 (Plug-ins and social media).

If special features occur on a project website (e.g. because other cookies are used or the project website has a functional relevance for data protection not described in these Data Protection Guidelines), this will be noted accordingly on the project website.

Communication – contact form and newsletter

If you use our contact form and the form for ordering our newsletter and subsequently for sending or providing the relevant information, we process the data you provide in the respective form and your message.

Only the form of address, first name and last name, email address, subject matter, subject line and the desired message are mandatory. All other information is voluntary. Your IP address and the date and time of the message or order will also be stored when you send your message.

If you would like to register for our newsletter or receive information on a current project, we use the so-called double opt-in procedure. This means that we first send you an email to the email address you have provided. In this email, we ask you to confirm that you wish to receive the newsletter or the requested information. If you do not confirm this within 24 hours, your data relating to the newsletter order or inquiry is blocked by us and automatically deleted after one month. The purpose of this procedure is to be able to prove your registration or inquiry and, if necessary, to prevent and clarify any possible misuse of your personal data.

Customer referral campaigns

If you participate in our customer referral campaigns, we process the data specified in the Communication section above and, where applicable, the data specified in the Prospective sellers or buyers section if you register with us as a new customer.

If you yourself have recruited a new customer as part of a customer referral campaign (“referrer”), the new customer may specify you as the referrer when registering. We generally ask for your name, address and email address in order to be able to contact you to carry out the customer referral campaign. We may also collect additional data from you directly that we need in order to carry out the customer referral campaign (e.g. account details for the purpose of paying out a commission).

Project management

When developing, planning, organising, coordinating and selling construction projects, we process the contact data (e.g. first name, last name, email address, telephone number) and, if necessary, other personal data of the parties involved that are required for project management, including the employees of our business partners and service providers as well as other persons involved in our business activities. This also includes processing your data using digital visualisation and project management platforms.

Prospective sellers and buyers

If you contact us as a prospective buyer or seller – directly or via a real estate agent – we process your contact details (e.g. first name, last name, address) and any other data required to conclude or implement a purchase agreement.

Office visit

If you visit us in our offices, we record your name, the name of your company, if applicable, and the times at which you enter and leave our office. In the event of corresponding official orders or legal requirements, we may collect additional data (e.g. contact details) from you.

Events

If you take part in one of our events and we take photographs and/or film footage of this event, we process your image if you can be seen in the photographs or film footage.

Applicant data

If you apply to us for employment, we process the personal data that you send us as part of an application (e.g. name, address, contact details, certificates, references).

6. What does BUWOG use your data for (purpose of processing) – and on what legal basis?

We process the aforementioned personal data in accordance with the provisions of the GDPR and the Austrian Data Protection Act (Bundesdatenschutzgesetz, BDSG). To specify:

6.1. Website visit

The legal basis for processing the data mentioned in Section 5 (Website visit) using non-essential cookies (see Section 9) and plug-ins (see Section 10) is your consent, which you may revoke at any time with effect for the future (Art. 6 [1] lit. a of the GDPR) and which you may declare via the cookie banner when you first access the website and when you activate the plug-ins individually in each case. Further details concerning revocation can be found under Section 12.

We use your data as well as the cookie and web-tracking tool data so that you are able to take full advantage of all of the functions of our website and for the needs-based design and optimisation of our website as well as for marketing purposes (see, in particular, Sections 9 and 10).

6.2. Contact form

Your consent, which may be revoked at any time with effect for the future (Art. 6 [1] lit. a of the GDPR), is the legal basis for processing the data you have voluntarily entered and your message to us. We use your data to process and respond to your (contact) inquiry. Further details concerning revocation can be found under Section 12.

6.3. Newsletter

Your consent, which may be revoked at any time with effect for the future (Art. 6 [1] lit. a of the GDPR), is the legal basis for sending you the newsletter, with which we inform you about the latest information of interest concerning BUWOG Group. We use your data to send the newsletter. Further information concerning revocation can be found under Section 12.

6.4. Carrying out customer referral campaigns

If you register with us as a new customer as part of customer referral campaigns, we process your data as described in Section 6.2 and, if applicable, Section 6.4.

If we receive your data as a “referrer” from a new customer as part of a customer referral campaign, we initially process your data on the basis of our legitimate interest in accordance with Art. 6 (1) lit. f of the GDPR. The processing takes place in order to be able to contact you and to coordinate your participation in the respective customer referral campaign. Your right to object to such processing is described in Section 12. Further processing of your data and, if necessary, the collection of additional data directly from you as a “referrer” takes place in order to carry out the customer referral campaign on the basis of Art. 6 (1) lit. b of the GDPR.

6.5. Sale or purchase of a property or piece of land

If you and BUWOG approach the conclusion of a contract based on your application or your enquiry concerning the sale or purchase of a property or plot of land, we process your data for the fulfilment of contractual or pre-contractual requirements in accordance with Art. 6 (1) lit. b of the GDPR. The purpose of the processing is the specific negotiation and preparation of a contract for purchasing property as well as its conclusion and implementation.

6.6. Provision of services

We also base the processing of your data in connection with the provision of other services on Art. 6 (1) lit. b of the GDPR, insofar as this is necessary for the fulfilment of (pre-)contractual requirements arising from the service contract between you and BUWOG.

6.7. Your initiation of contact and website use

BUWOG processes personal data (e.g. IP address, date and time of the message) that is transmitted when you use our website (or a project website) and when you send us messages (e.g. via our contact form, the newsletter) on the basis of our legitimate interests in accordance with Art. 6 (1) lit. f of the GDPR. The processing is carried out to prevent misuse and to ensure the security of our information technology systems. In the specific case, these interests outweigh the rights and freedoms of the website users concerned. Your right to object to such processing is described in Section 12.

6.8. Assistance with the sale or purchase of a property or plot of land

Insofar as we are not sellers or buyers ourselves, we process your personal data in connection with your application or inquiry concerning the sale or purchase of a property or land on the basis of our legitimate interest in responding to your inquiries in accordance with Art. 6 (1) lit. f of the GDPR. Your right to object to such processing is described in Section 12.

6.9. Settlement of legal disputes, assertion, exercise and defence of legal claims

We process your data for and in connection with legal prosecution (for example in connection with rights and obligations arising from the GDPR) on the basis of our legitimate interests in this regard (Art. 6 [1] lit. f of the GDPR), which outweigh the rights and freedoms of the data subjects. Your right to object to such processing is described in Section 12.

6.10. BUWOG Group

So that we can offer you the best possible service and remain competitive, as well as to manage and improve our services, we exchange data within BUWOG Group (within the EU) on the basis of our legitimate interests (in accordance with Art. 6 [1] lit f of the GDPR), e.g. by forwarding inquiries from customers that concern another company in BUWOG Group to that company. These interests outweigh the rights and freedoms of the data subjects. Your right to object to such processing is described in Section 12.

6.11. Marketing and direct marketing

We use your data on the basis of our legitimate interests for the purpose of direct marketing (e.g. to conduct customer surveys, opinion polls, marketing campaigns, market analyses, prize draws, competitions or similar campaigns and events) and in accordance with Art. 6 (1) lit. f of the GDPR, provided that your rights and freedoms do not prevail. In this context, we also analyse the results of (direct) marketing activities in order to measure the efficiency and relevance of our measures. Your right to object to such processing is described in Section 12.

6.12. Project management

Insofar as we process personal data in connection with the development, planning, organisation and coordination of construction projects or the resulting warranty management, we base this on our legitimate business interests in the provision of project management services (Art. 6 [1] lit. f of the GDPR), which outweigh the rights and freedoms of the data subjects. Your right to object to such processing is described in Section 12. Insofar as we obtain your consent for the disclosure of your contact data or other personal data to third parties (e.g. tradespersons, construction management or condominium management), the data is disclosed on the basis of your consent, which may be revoked at any time with effect for the future (Art. 6 [1] lit. a of the GDPR). Further details concerning revocation can be fund under Section 12.

6.13. Corporate and real estate transactions

In connection with a corporate transaction, a risk assessment (due diligence) is carried out at the BUWOG Group company to be sold or the company to be purchased. Personal data is also processed in the course of this. The same applies to the purchase or sale of properties. The data is processed in accordance with Art. 6 (1) lit. f of the GDPR on the basis of our legitimate interest in having the company or property to be sold or purchased examined for the sale or purchase with the help of a risk assessment, provided that the rights and freedoms of the data subjects do not prevail. Your right to object to such processing is described in Section 12.

6.14. Compliance with legal requirements

BUWOG processes personal data in order to comply with legal obligations on the basis of tax law as well as reporting and information obligations with respect to authorities (Art. 6 [1] lit. c of the GDPR). Legal requirements include tax and commercial storage obligations as well as existing requirements for carrying out supervisory measures to prevent white-collar crime or money laundering.

6.15. Office visits

The processing of your personal data that we collect when you visit our offices is carried out firstly to ensure that only authorised persons are on our premises. On the other hand, the processing is necessary for fire and safety reasons in order to be able to trace which persons are in the building in the event of a safety-related incident (e.g. fire or theft). The legal basis for data processing is our legitimate interest in the security of our office premises in accordance with Art. 6 (1) lit. f of the GDPR.

Insofar as we are required to collect, store or otherwise process your data due to legal regulations or official orders, the data processing is carried out to fulfil our legal obligations in accordance with Art. 6 (1) lit. c of the GDPR.

6.16. Events

If we take photographs and/or film footage of you at events, we process your image for the purposes of documenting the event, for internal and external corporate communications, for marketing purposes on our website or our social media channels (e.g. Facebook, Instagram, LinkedIn, YouTube ) or for press purposes. The legal basis for the creation of the image and its publication is your consent (Art. 6 [1] lit. a of the GDPR). In the case of photos / videos that do not specifically depict individual event visitors (such as portraits), but rather recordings of the event in which people may only be depicted in the crowd or as an accessory, we process this personal data on the basis of our legitimate interest in documenting and providing information about our events in accordance with Art. 6 (1) sentence 1 lit. f of the GDPR.

6.17. Your application

If you apply for a job at BUWOG and provide us with your data in the scope of this, the data protection information for applicants at Vonovia SE, available at https://www.vonovia.com/en/privacy-policy#dse, applies.

6.18. Video surveillance

In some cases, video surveillance is used at regional construction sites; information concerning this can be obtained at the respective construction sites.

It is used after careful consideration if other measures have proven unsuccessful or do not appear promising based on concrete experience. The areas that are monitored are labelled accordingly. Data processing is carried out in accordance with Art. 6 (1) sentence 1 lit. f of the GDPR and serves the following purposes, which also represent the legitimate interests of BUWOG:

  • Protection of the safety of customers and tenants, service providers and employees as well as their property
  • Protection of the material and intellectual property of the company as well as of its purchasers, tenants and service providers
  • The execution and guarantee of house rules
  • Securing evidence in connection with criminal activity

The specific purpose of the camera can be found on the local signage. In individual cases, the recordings may be passed on to law enforcement authorities in accordance with the purpose.

7. Who receives your data?

In order for us to offer you the best possible service and remain competitive, we exchange data within the BUWOG Group, as described in Section 6.9, if this is necessary to safeguard our legitimate interests and your interests or fundamental rights and freedoms do not outweigh our interests.

We also transfer your personal data to the following recipients for the following purposes:

Public authorities

BUWOG provides personal data to courts, regulators, tax authorities and other public authorities in exceptional cases as required by law (e.g. in cases of emergency, criminal prosecution or the prevention of money laundering).

External service providers

BUWOG makes use of the following external service providers and contractual partners to be able to benefit from their particular expertise: (i) real estate agents, (ii) property management companies, (iii) consultants (including energy consultants), (iv) service providers, (v) marketing agencies, (vi) IT service providers, (vii) project developers, (viii) trades, (ix) banks, (x) insurers, (xi) property management companies and (xii) Vonovia SE (HRB  16879, Universitätsstraße 133, D-44803 Bochum).

Insofar as the aforementioned third parties are not themselves responsible in accordance with Art. 4 (7) of the GDPR for processing the data transferred, they process your personal data on our behalf in accordance with Art. 28 of the GDPR as so-called processors. Processors only act in accordance with BUWOG’s instructions and are contractually required to comply with the applicable data protection requirements with respect to BUWOG.

8. Is data transferred to a third-party country or to an international organisation?

Data is only transferred to countries outside the EU or the EEA (so-called third-party countries) to the extent it is required for the execution of your orders, it is required by law (e.g. tax reporting obligations), or you have provided us with consent (e.g. cookies, social media and tracking tools).

9. Cookie use

Cookies are small text files that store and/or read out various information on the user's computer when the user accesses our website. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall. The cookies used on our website are divided into the categories necessary, marketing, preferences and statistics. The classification of the respective cookies was displayed when you accessed the website and can be accessed via the “Privacy settings” tick box on the website.

Cookies in the necessary category are essential for the operation of the website. Without them, the website cannot be correctly displayed. They also ensure user-friendly, effective and secure access to the website.

Cookies in the categories of marketing, statistics and/or preferences (together “non-essential cookies”) are used to personalise content and advertisements, to recognise our website visitors, to offer social media functions, to record statistical information, to pursue marketing purposes using web tracking tools and to be able to target offers more specifically. If you have consented to the use of unnecessary cookies, these unnecessary cookies will be stored on your computer based on your consent. Unless you have given your consent to the use of such cookies, no processing will take place using unnecessary cookies. Your consent may be revoked at any time by changing your settings via the “Privacy settings” tick box on the website.

Our website and the project websites use cookies from the providers specified when the websites are accessed, the scope and function of which are explained below.

9.1 Google

BUWOG uses cookies from the provider Google Ireland Ltd (“Google”) on the basis of your consent. Below we explain which Google tools we use and how Google collects personal data. Unless expressly described otherwise, the information concerning data processing by Google for YouTube applies to the other services accordingly:

YouTube

According to company information, Google uses YouTube cookies to collect data concerning the browsers and devices you use in order to access our website. This data includes the browser’s unique identifiers, type and settings. Google also collects data concerning the interaction of your browsers and devices with our services. This includes the IP address, crash reports, system activity and the date, time and referral URL of your request.

Among other things, the following activity data may be collected: terms you search for; videos you watch; content and adverts you view and interact with; voice and audio data when you use audio features; purchase activity; people you communicate or share content with; activity on third-party websites that use our services; and the Chrome browsing history that you have synchronised with your Google account.

In addition, using GPS, we collect IP addresses (your IP address identified by Google will be shortened in advance within member states of the European Union or in other states party to the Agreement on the European Economic Area due to the extension “_anonymizelp()” used on this website; only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there), sensor data from your device, information concerning objects (such as WLAN access points, radio masts and Bluetooth-enabled devices) in the vicinity of your device, and data concerning your location.

Google uses this information to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. Google may also use this data for its own purposes.

Further information on data protection at and data processing by Google can be found here: https://policies.google.com/privacy?hl=en.

ReCAPTCHA

The abbreviation CAPTCHA stands for “Completely Automated Public Turing Test to Tell Computers and Humans Apart”. Captchas protect the website’s services from being used by BOTS (computers).

Use of DoubleClick

Google’s DoubleClick (“DoubleClick”) uses cookies to display adverts that are relevant to users, to improve campaign performance reports or to prevent a user from seeing the same adverts more than once. Google uses a cookie ID to record which adverts are displayed in which browser and can thus prevent them from being displayed more than once. In addition, DoubleClick can use cookie IDs to record conversions that are related to ad requests. This is the case, for example, when a user sees a DoubleClick advert and later visits the advertiser’s website with the same browser and makes a purchase there.

Google Adwords conversion tracking

We use Google Adwords to draw attention to our attractive offers on external websites with the help of advertising material (so-called Google Adwords). We can determine how successful the individual advertising measures are in relation to the advertising campaign data. We are interested in showing you adverts that are of interest to you, making our website more interesting for you and achieving a fair calculation of advertising costs.

These adverts are delivered by Google via so-called “ad servers”. For this purpose, we use ad server cookies, through which certain parameters for measuring success, such as the display of adverts or clicks by users, can be measured. If you access our website via a Google advert, Google Adwords will store a cookie on your PC.

9.2 Microsoft - Bing Ads conversion tracking

We also use Bing Ads conversion tracking, a web analytics service provided by the Microsoft Cooperation (“Microsoft”), based in Redmond, WA 98052-6399, USA. Bing Ads also enables an evaluation of visitor activity. Microsoft uses this website analysis to measure the effectiveness with which a group of people that  is addressed is encouraged to carry out desired actions (e.g. how many users register for the newsletter or apply for a property on the basis of an advert on the Bing search engine on the website). Microsoft Bing Ads stores a cookie on your computer if you have reached our website via a Microsoft Bing advert. We and Microsoft Bing are able to therefore detect that someone has clicked on an advert, has been redirected to our website and has reached a predetermined target page (conversion page). We only learn the total number of users who clicked on a Bing advert and were then forwarded to the conversion page. Data processing is based on your consent, which you may revoke at any time, as explained above in Section 6.1.

For more information concerning data protection and cookies used at Microsoft and Bing Ads, visit Microsoft’s website at https://privacy.microsoft.com/en-us/privacystatement.

10. Plug-ins, third-party content and social media

Google Maps

We use the Google Maps map service, which is operated by Google. Further information about embedding the maps from Google Maps can be found here: https://support.google.com/maps/answer/144361?co=GENIE.Platform%3DDesktop&hl=en.

If you call up a page of our website that contains a Google Maps plug-in, your browser establishes a direct connection to the servers of the respective provider. The content of the plug-in is transmitted directly to your browser and integrated into the page. Through the integration of the plug-in, the provider receives the information that your browser has called up the corresponding page of our website. This information (including your IP address) is transmitted by your browser directly to a server of the respective provider in the USA or in Germany and stored there. If you are logged in to Google, Google can directly assign your visit to our website to your profile. If you interact with the plug-ins and activate the corresponding buttons, the corresponding information is also transmitted directly to Google and stored there.

For the purpose and scope of data collection and for the further processing and use of data by the providers, as well as your rights and settings options for protecting your privacy, please refer to the Google Maps Data Protection Guidelines: https://policies.google.com/privacy?hl=en&gl=de.

Squarebytes

We use a plug-in from the Austrian provider Squarebytes on several project websites. With this tool, visitors are able to view visualisations of the buildings and apartments in planning or under construction, as well as apartment floor plans, and if interested, make a specific request for a particular apartment. This request first goes to Squarebytes and is then forwarded to us.

We have concluded a data processing agreement with the provider. Squarebytes processes the data received exclusively on our instructions.

Social Media

We are represented on various social media channels (currently Facebook, Instagram, LinkedIn, YouTube and Twitter), on which we regularly publish reports and photos to inform you about our company and our products and services. On the social media channels you have the opportunity to react to our “posts” and communicate with us. In doing so, we may process your personal data based on our legitimate interest in answering your comments / questions / suggestions and in promoting our products and services in accordance with Art. 6 (1) sentence 1 lit f of the GDPR. The data protection information of the social media channel you use applies to the use of Facebook, Instagram, LinkedIn, YouTube and Twitter.

Hypofriend

Some of our project websites include a link to our cooperation partner Hypofriend, Hypofriend GmbH, Torstraße 92, 10119 Berlin. Visitors to the project website can use the link to use Hypofriend’s financing service and work together with a licensed mortgage advisor. For this purpose, visitors transmit contact details such as their first name, last name, email address and telephone number directly to Hypofriend. For further information on the type, purpose and scope as well as the further processing and use of your data by Hypofriend, please refer to Privacy Policy of Hypofriend.

HOME

Our website includes a link to our cooperation partner HOME, Home HT GmbH | Mulackstr. 19 | 10119 Berlin. Visitors to our website can use the link to use HOME's rental service. For this purpose, visitors transmit contact details such as their first name, last name, email address and telephone number to HOME. For further information on the type, purpose and scope as well as the further processing and use of your data by HOME, please refer to HOME’s privacy policy (in German only). https://www.buena.com/datenschutz

11. How long is my data stored?

BUWOG processes and stores your personal data as long as it is necessary to achieve the purpose for which it is being collected. If the data is no longer necessary to achieve the purpose of its collection, it is deleted unless its – temporary – (further) processing is necessary for the following purposes:

Legal retention periods

To comply with the statutory (commercial and tax) periods for storage and documentation in the German Commercial Code (Handelsgesetzbuch, HGB) and the German Fiscal Code (Abgabenordnung, AO): these periods are up to ten years.

Evidence

To preserve evidence in the scope of the statutory limitation periods: In accordance with Section 195 ff. of the German Civil Code (Bürgerliches Gesetzbuch, BGB), these limitation periods can be up to thirty years, whereby the regular period of limitation is three years.

In addition, the following apply to storage with regard to individual processes:

Website visit

Your data is deleted as soon as the respective session has ended. Log files are deleted after seven days. Further storage is possible in exceptional circumstances, but in this case the IP addresses of the users are deleted or encrypted so that an assignment of the accessing client is no longer possible.

Contact form

Your data from the contact form’s input mask is deleted when the respective conversation with you ends. The  conversation ends when it can be inferred from the circumstances that the matter in question has been ultimately clarified and that there are no justified reasons for further storage of the data.

Additional personal data (e.g. IP address) collected during the sending process is deleted at the latest following a period of seven days.

Application for a property

Your data from the data mask to apply for a property is deleted six months after the property has been sold. In addition, your data is deleted from the application form if you have not agreed to a confirmation request from us that we may contact you within 14 days of receipt of the request.

Additional personal data (e.g. IP address) collected during the sending process is deleted at the latest after a period of seven days.

Office visit

Subject to varying statutory retention periods, data collected during your visit to our office premises will be deleted within 14 days, unless the continued storage of the data is necessary for evidentiary purposes (e.g. in the event of theft).

Newsletter

When you, as a visitor to our website, sign up for our newsletter, BUWOG uses the so-called double opt-in procedure described above under Section 5. If you do not confirm your registration within 24 hours, your information is blocked and automatically deleted after one month.

We rely on your consent for sending a newsletter until you revoke such consent. After the revocation of your consent, we delete your personal data within 14 days. Such revocation does not affect the legality of the processing carried out prior to the revocation on the basis of consent.

Additional personal data (e.g. IP address) collected during the sending process is deleted at the latest after a period of seven days.

Customer referral campaigns

If you register with us as a new customer as part of a customer referral campaign, your data (in the event of a sale) is stored for the duration of the statutory retention periods (see above). If you contact us beyond this (e.g. register for the newsletter), the aforementioned information concerning storage applies.

If we receive your data as a “referrer” from a new customer as part of a customer referral campaign, we process your data for these purposes for the duration of the customer recommendation campaign specified in the respective terms and conditions of participation. If your data is already being processed by us for other purposes, we store it for the duration of the existing purposes (e.g. for customers to carry out the contractual relationship).

12. What rights to data protection do I have?

As a data subject, you have the following rights (“rights of the data subject”) in accordance with the GDPR:

Right of access:

In accordance with Art. 15 of the GDPR, you may request information from us on whether BUWOG processes your personal data and what data that includes.

Right to rectification:

If your information is incorrect, you may request a correction in accordance with Art. 16 of the GDPR. If your data is incomplete, you may request its completion. If BUWOG has disclosed your data to third parties, these third parties are informed of your correction – insofar as this is required by law.

Right to erasure of personal data:

You have the right to delete your data with BUWOG, provided that the requirements of Art. 17 of the GDPR are met (particularly if the purposes for which your data was collected or processed no longer apply).

Right to restriction of processing:

You have the right to restrict the processing of your data, provided that the requirements of Art. 18 of the GDPR are met.

Right to data portability:

If you wish, in accordance with Art. 20 of the GDPR, we will also provide you with your data for further use or transmit it to a recipient you designate.

Right to revocation of consent (similar to exercise of cookies under Section 9):

If consent has been given to process your personal data, the right to revoke the consent granted at any time with future effect shall apply, i.e. the revocation does not affect the legality of the processing carried out prior to the revocation on the basis of consent. Revocation may occur in any form, e.g. by email to datenschutz-bautraeger@buwog.com (for newsletters to newsletter@buwog.com), by sending a message to the contact details provided above under Section 3.1 or in the respective legal notice of the project website or by clicking on the unsubscribe link provided in every newsletter email.

Following successful revocation, BUWOG is only permitted to process your personal data insofar as processing is still necessary for BUWOG on the basis of statutory requirements.

Right to object to processing:

In accordance with Art. 21 (1) of the GDPR, you have the right at any time to object to the processing of personal data on the basis of Art. 6 (1) lit f of the GDPR (data processing to safeguard legitimate interests).

If you lodge an objection, we will no longer process your personal data for the purposes covered by the objection, unless we can demonstrate compelling legitimate reasons that override the interest, rights and freedoms of the data subject or the processing services the establishment, exercise or defence of legal claims.

Insofar as the objection is also or only directed against the processing of data for direct advertising, we will no longer process your personal data for this purpose.

The objection may be lodged informally, e.g. by email to datenschutz-bautraeger@buwog.com or by a message to the contact details mentioned under Section 3.1.

Right to lodge a complaint:

There is also a right to lodge a complaint with a data protection supervisory authority (Art. 77 of the GDPR).

However, we recommend that you first direct a complaint to our data protection team. The contact details can be found under Section 3.2.

13. Effect of non-communication

If the aforementioned personal data is not provided, BUWOG cannot collect it. In that case, it is impossible to achieve the specified objectives. For example, your application for a particular rental property cannot be considered.