Data privacy
Information on data protection
With this privacy policy, we inform you about our handling of your personal data and about your rights according to the European Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). GATOR Beteiligungsverwaltungsgesellschaft mbH (hereinafter referred to as "we" or "us") is responsible for data processing.
Content
I. General information
1. Contact
2. Legal basis
3. Duration of storage
4. Categories of recipients of the data
5. Processing in the exercise of your rights
6. Your rights
7. Right to object
8. Data Protection Officer
II. Data processing on our website
1. Processing of server log files
2. Contact options and enquiries
3. Job applications
4. Cookies
III. Data processing for rental
1. Prospective tenants
2. Tenants
IV. Further data processing
1. Contact by e-mail
2. Customer and interested party data
I. General information
1. Contact
If you have any questions or suggestions about this information, or if you wish to contact us about asserting your rights, please send your request to:
GATOR Beteiligungsverwaltungsgesellschaft mbH
Große Theaterstraße 1A
2. Legal basis
The term "personal data" under data protection law refers to all information that relates to an identified or identifiable individual. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. Data processing by us only takes place on the basis of a legal permission. We process personal data only with your consent (Section 25 (1) TTDSG or Art. 6 (1) a GDPR), for the performance of a contract to which you are a party or at your request for the implementation of pre-contractual measures (Art. 6 (1) b GDPR), for the fulfilment of a legal obligation (Art. 6(1)(c) GDPR) or where processing is necessary for the purposes of protecting our legitimate interests or the legitimate interests of a third party, unless such interests are overridden by your interests or fundamental rights and freedoms which require the protection of personal data (Art. 6(1)(f) GDPR). If you apply for a vacancy in our company, we will also process your personal data for the purpose of deciding on the establishment of an employment relationship (Section 26 (1) sentence 1 BDSG).
3. Duration of storage
Unless stated otherwise in the following notes, we only store the data for as long as it is necessary to achieve the processing purpose or to fulfil our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will retain such personal data contained in our accounting records for ten years and retain personal data contained in commercial letters and contracts for six years. In addition, we will retain data in connection with consents requiring proof as well as data in connection with claims for the duration of the statutory limitation periods. Further information on the storage period in the tenancy relationship can be found in the section "Duration of data storage in the tenancy relationship".
4. Categories of recipients of the data
We use processors for the processing of your data. Processing operations carried out by such processors include, for example, hosting, emailing, maintenance and support of IT systems, customer management, accounting and billing, marketing activities or file and data carrier destruction. A processor is a natural or legal person, public authority, institution or other body that processes personal data on behalf of the data controller. Processors do not use the data for their own purposes but carry out data processing exclusively for the data controller and are contractually obliged to guarantee appropriate technical and organizational measures for data protection. In addition, we may transmit your personal data to bodies such as postal and delivery services, house bank, tax consultancy/auditing company or the financial administration. For the purpose of tracing infections, data may be transferred to the responsible public health department. Further recipients may result from the following note, in particular the section "Categories of recipients of personal data in the tenancy relationship".
5. Processing in the exercise of your rights
If you exercise your rights in accordance with Articles 15 to 22 of the GDPR, we will process the personal data provided for the purpose of implementing these rights by us and to be able to provide evidence of this. Data stored for the purpose of providing and preparing information will only be processed for this purpose and for the purpose of data protection control and otherwise restrict processing in accordance with Art. 18 GDPR. These processing operations are based on the legal basis of Art. 6 para. 1 lit. c GDPR in conjunction with. Articles 15 to 22 GDPR and Section 34 (2) BDSG.
6. Your rights
As a data subject, you have the right to assert your data subject rights towards us. In particular, you have the following rights:
- In accordance with Art. 15 GDPR and § 34 BDSG, you have the right to request information as to whether and, if so, to what extent we are processing personal data relating to you or not.
- You have the right to demand that we correct your data in accordance with Art. 16 GDPR.
- You have the right to demand that we delete your personal data in accordance with Art. 17 GDPR and § 35 BDSG.
- You have the right to have the processing of your personal data restricted in accordance with Art. 18 GDPR.
- You have the right, in accordance with Art. 20 GDPR, to receive the personal data you have provided to us in a structured, common and machine-readable format and to transfer this data to another controller.
- If you have given us separate consent to data processing, you may revoke this consent at any time in accordance with Art. 7 (3) GDPR. Such a revocation does not affect the lawfulness of the processing that was carried out on the basis of the consent until the revocation.
- If you are of the opinion that a processing of personal data concerning you violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.
7. Right to object
In accordance with Article 21(1) of the GDPR, you have the right to object to processing based on the legal basis of Article 6(1)(e) or (f) of the GDPR on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you may object to this processing pursuant to Article 21 (2) and (3) of the GDPR.
8. Data Protection Officer
You can reach our data protection officer at the following contact details:
E-Mail:
Herting Oberbeck Datenschutz GmbH
Hallerstr. 76, 20146 Hamburg
II. Data processing on our website
When you use the website, we collect information that you provide yourself. In addition, during your visit to the website, we automatically collect certain information about your use of the website. In data protection law, the IP address is also generally considered to be a personal data. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.
1. Processing of server log files
During the purely informative use of our website, general information that your browser transmits to our server is initially stored automatically (i.e. not via registration). This includes by default: browser type/version, operating system used, page accessed, the previously visited page (referrer URL), IP address, date and time of the server request and HTTP status code. The processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6 (1) f GDPR. This processing serves the technical administration and security of the website. The stored data is deleted after seven days, unless there is a justified suspicion of unlawful use based on concrete indications and further examination and processing of the information is necessary for this reason. We are not able to identify you as a data subject from the stored information. Articles 15 to 22 of the GDPR therefore do not apply pursuant to Article 11 (2) of the GDPR unless you provide additional information to us, for exercising your rights set out in these articles, that enables us to identify you.
2. Contact options and enquiries
Our website contains contact forms that you can use to send us messages. The transfer of your data is encrypted (recognisable by the "https" in the address line of the browser). All data fields marked as mandatory are required to process your request. Failure to provide this information will result in us not being able to process your request. The provision of further data is voluntary. Alternatively, you can send us a message via the contact e-mail. We process the data for the purpose of answering your enquiry. Insofar as your enquiry is directed towards the conclusion or performance of a contract with us, Art. 6 para. 1 letter b GDPR is the legal basis for the data processing. Otherwise, we process the data on the basis of our legitimate interest in contacting enquirers. The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR.
3. Job applications
You have the option of applying via our website in the career section. For this purpose, we collect personal data from you, including in particular your name, CV, letter of application and other content provided by you. Your personal application data will only be processed for purposes related to your interest in current or future employment with us and the processing of your application. Your application will only be processed and noted by the relevant contacts at our company. All employees entrusted with data processing are obliged to maintain the confidentiality of your data. If we are unable to offer you employment, we will retain the data you have provided for up to six months after the end of the application process for the purpose of answering questions relating to your application and rejection. This does not apply if legal provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage. The legal basis for the collection of data is § 26 para. 1 p. 1 BDSG.
If we retain your applicant data for longer than six months and you have expressly consented to this, we would like to point out that this consent can be freely revoked at any time in accordance with Art. 7 (3) GDPR. Such a revocation does not affect the lawfulness of the processing that was carried out on the basis of the consent until the revocation.
4. Cookies
We use cookies and similar technologies ("cookies") on our website. Cookies are small data sets that are stored by your browser when you visit a website. This identifies the browser you are using and can be recognised by web servers. You have full control over the use of cookies through your browser. You can delete the cookies in the security settings of your browser at any time. You can object to the use of cookies through your browser settings in principle or for specific cases. We only use cookies that are technically necessary for the operation of our website and are therefore permitted without your consent.
III. Data processing for rental
1. Prospective tenants
To arrange a viewing appointment, name and contact details are processed. The legal basis for the processing is Art. 6(1)(f) GDPR and the processing serves our legitimate interest in contacting you.
If prospective tenants declare that they wish to rent an offered apartment, further data will be collected. This includes, for example, information on professional activity, employer and household size. This is done for the purpose of deciding which prospective tenants come into consideration for renting rooms. If a tenancy agreement is subsequently to be concluded, further data will be collected in order to conclude the contract. The legal basis for this processing is in each case Art. 6 Para. 1 Letter b GDPR and the processing is necessary to initiate the tenancy.
In order to obtain proof of the creditworthiness of the future tenants and if this proof has not already been sufficiently provided in another form, a SCHUFA credit report for landlords is obtained via SCHUFA Holding AG (Germany, EU). The legal basis for this processing is Art. 6 para. 1 lit. f GDPR.
We process and store the personal data collected about prospective tenants until a contract has been concluded in the respective tender and there are no longer any statutory retention obligations.
2. Tenants
The processing of your personal master, contract and payment data is regularly required for the establishment and implementation of the tenancy. In addition to the data of the above-mentioned data categories, this includes in particular payment data, documentation data, data from consultation and service talks as well as comparable data. The legal basis for this processing is Art. 6 Para. 1 Letter b GDPR.
In order to implement the tenancy and look after the property, we may commission craftsmen, caretakers and other service providers. In order to provide tenants with regular information on their heating costs in accordance with the German Heating Costs Regulation (Heizkostenverordnung), we reserve the right to transmit your contact details and e-mail address to the billing companies commissioned by us. The transmission of your data required for this serves our legitimate interest in a smooth implementation of the tenancy relationship as well as the resource-saving fulfilment of our legal obligations towards our tenants and is based on the legal basis of Art. 6 Para. 1 Letter f GDPR.
Further data processing is only carried out with your consent in accordance with Art. 6 para. 1 lit. a GDPR or on the basis of Art. 6 para. 1 lit. c GDPR, insofar as this is necessary for the fulfilment of legal obligations to which we are subject as a company. These processing purposes include, for example, retention obligations under commercial and tax law in accordance with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO).
Your personal data will be stored for the duration of the tenancy. Beyond this duration, the personal data collected is stored if there is a legal obligation to do so. Corresponding obligations of proof and storage result from the German Civil Code (Bürgerliches Gesetzbuch), the German Commercial Code (Handelsgesetzbuch) and the German Tax Code (Abgabenordnung). The periods specified there for storage or documentation are six years in accordance with commercial law requirements under § 257 HGB and up to ten years due to tax requirements under § 147 AO. In all other respects, the statutory limitation period of three years applies according to §§ 195, 199 BGB.
Within our company, only those departments that need your data to fulfil contractual and legal obligations will receive access to it. Processors appointed by us (Art. 28 GDPR) may also receive data for these purposes. Processors only process data according to our instructions and may not use it for their own purposes. We work with the following categories of processors within the framework of the tenancy:
- Meter reading and billing service,
- water and energy supply,
- caretaker and cleaning service,
- project management.
In the context of the tenancy relationship, the data may also be passed on to the following recipients: Heating cost billing service providers or commissioned craftsmen. Further recipients of the data can be found in the section "Categories of recipients of the data".
IV. Further data processing
1. Contact by e-mail
If you send us a message via the contact email provided, we will process the data submitted for the purpose of responding to your enquiry. We process this data based on our legitimate interest in contacting enquirers. The legal basis for the data processing is Art. 6 para. 1 letter f GDPR.
2. Customer and interested party data
If you contact our company as a customer or interested party outside of a tenancy relationship, we process your data to the extent necessary to establish or implement the contractual relationship. This regularly includes the processing of the personal master, contract and payment data provided to us as well as contact and communication data of our contact persons for commercial customers and business partners. The legal basis for this processing is Art. 6 Para. 1 Letter f GDPR.
We also process customer and interested party data for evaluation and marketing purposes. This processing is carried out on the legal basis of Art. 6 Para. 1 Letter f GDPR and serves our interest in further developing our offers and informing you specifically about our offers.
Further data processing may take place if you have consented (Art. 6 para. 1 letter a GDPR) or if this is necessary for the fulfilment of a legal obligation (Art. 6 para. 1 letter c GDPR).
Stand: 17.08.2022