Information on Data Processing of Personal Data of Customers, Interested Parties, Suppliers and Other External Persons According to Artt. 12, 13, 21 GDPR

We take the protection of your personal data very seriously. We process your data in accordance with the applicable data protection regulations. In the following, we inform you about the processing of your data according to Artt. 12, 13, 21 of the General Data Protection Regulation (GDPR).

1. Who is Responsible for Data Processing? (Art. 13 para. 1 a, b GDPR)

Responsible for data processing is:

AENGEVELT Immobilien GmbH & Co. KG
Kennedydamm 55, 40476 Düsseldorf
Phone number: +49 211 8391-0
Email: kontakt@aengevelt.com

Questions regarding data protection can be sent to:

AENGEVELT Immobilien GmbH & Co. KG
To the Data Protection Officer
Kennedydamm 55, 40476 Düsseldorf
Phone number: +49 211 8391-276
Email: Datenschutz@aengevelt.com

2. For What Purposes and on What Legal Basis Do We Process Your Personal Data? (Art. 13 para. 1 c, d and 2 f GDPR)

We only process personal data that you provide to us as part of the business transaction. The legal basis results from Art. 6 GDPR. The purposes of the processing depend on your request or the respective business transaction.

We process personal data primarily for the fulfillment of contractual obligations (Art. 6 (1) b) GDPR), more specifically for the purpose of initiating, executing or fulfilling a contract. For example, these are also the preparation of offers, invoicing and answering general inquiries. If a data subject is not a contractual partner himself – for example, an employee of a business partner – the processing is carried out for the same purposes as a legitimate interest pursuant to Art. 6 (1) f) GDPR.

In addition, we process personal data to protect the following legitimate interests (Art. 6 para. 1 f) GDPR): Maintaining the business relationship, ensuring IT operations and security, and asserting legal claims and defending legal disputes.

Depending on the nature of the business transaction or your request, we store your personal data to the extent necessary within the scope of the purpose limitation and market custom in our communication and real estate management systems.

Only if this is part of our contractual relationship or if we have received your consent to do so (pursuant to Art. 6 (1) a) GDPR), we process your personal data for the purpose of providing information and advice on products and services, as well as for market research and customer satisfaction analysis and for forwarding to third parties.

For the fulfillment of legal requirements, we process, if necessary, your personal data and disclose them to third parties (Art. 6 para.1 c) GDPR).

We do not use your personal data in any way for automated decision-making processes or profiling.

Our company regularly checks and monitors customers, including existing ones, for creditworthiness whenever contracts are concluded and also in certain cases when there is a legitimate interest. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. b and lit. f GDPR.

We therefore collaborate with Creditreform Boniversum GmbH – address: Hammfelddamm 13, 41460 Neuss, Germany – which provides us with the relevant data. For this purpose, we transmit your name, address, and date of birth to Creditreform Boniversum GmbH.

The information on the data processing conducted by Creditreform Boniversum GmbH is based on the EU General Data Protection Regulation, article 14, which can be found here:

The information pursuant to Art. 14 GDPR on the data processing taking place at Creditreform Boniversum GmbH can be found here: https://www.boniversum.de/eu-dsgvo/informationen-nach-eu-dsgvo-fuer-verbraucher

3. Who Receives Your Personal Data? (Art. 13 para. 1 e, f GDPR)

As a matter of principle, we do not pass on personal data to third parties who process it under their own responsibility (Art. 4 No. 7 GDPR), unless you have given your consent to do so, there is a legal regulation that obliges us to do so or we have a legitimate interest.

If we outsource parts of the data processing to service providers by way of commissioned processing, we conclude corresponding commissioned processing contracts with these suppliers pursuant to Art. 28 GDPR. We use the following categories of service providers:

• IT service providers
• Financial service providers

We process your data exclusively in Germany and have no intention of processing the data in third countries.

4. How Long Will the Data Be Stored? (Art. 13 para. 2 a GDPR)

We only process your personal data for as long as it is required to fulfill the above-mentioned purposes.

The legislator has also enacted a variety of retention obligations and periods that we must comply with. These result, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods specified there are up to ten years. After the purpose of processing no longer applies and any applicable retention period has expired, the relevant personal data is routinely deleted in accordance with data protection requirements.

5. What Rights and Obligations Do You Have? (Art. 13 para. 2 b, c, d, e GDPR)

Every data subject has the following rights:

• according to Art. 15 GDPR – Right of access by the data subject
• according to Art. 16 GDPR – Right to rectification
• according to Art. 17 GDPR – Right to erasure (‘right to be forgotten’)
• according to Art. 18 GDPR – Right to restriction of processing
• according to Art. 20 GDPR – Right to data portability
• according to Art. 77 GDPR – Right to lodge a complaint with a supervisory authority
• according to Art. 7 para. 3 GDPR, the right to withdraw a given consent at any time.

In addition, you have the right to object, which we explain in more detail at the end of this data protection information.

If you wish to exercise your rights, please contact the data protection officer in writing (by mail or e-mail) (see above for contact details).

Further general information

Changes to this data protection declaration

We review the privacy policy at regular intervals for conformity with statutory provisions, case law, the statements of the supervisory authorities as well as for alignment with emerging trends and the development of technical standards. In this respect, we reserve the right to make changes to the privacy policy to adapt it to new legal provisions on data protection and other changes in the factual or legal situation. Therefore, please always inform yourself about the data protection declaration applicable at that time when you start using our services.

Competent Supervisory Authority

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Home address: Kavalleriestr. 2 – 4, 40312 Düsseldorf
Postal address: Post office box 20 04 44, 40102 Düsseldorf
Phone number: +49 211 38424-0
Email: poststelle@ldi.nrw.de

Information about your right to object according to Art. 21 of the General Data Protection Regulation (GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR (data processing on the basis of a balance of interests); this also applies to any profiling based on this provision within the meaning of Article 4 No. 4 of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

The objection can be made form-free and should, if possible, be addressed to the offices named in the data protection declaration in section "Person responsible" or "Data protection officer".