Privacy Policy

1. General Information and Mandatory Information

Grand City Property takes the protection of your personal data very seriously. We treat your personal data confidential and in accordance with the statutory data protection regulations and this Privacy Policy.

If you use this website, various personal data will be collected. Personal data means data that relates to an identified or identifiable natural person. This includes, for example, your name, your address and your IP address. This Privacy Policy explains what data we collect and for what purposes.

Note on the controller

The controller for the data processing on this website is:

Grand City Property Ltd. Germany Branch
Wittestrasse 30, Building F, 13509 Berlin
Phone: 0800 646 377 200
Email: [email protected]

The data protection officer can be reached at the email address [email protected] or by mail to Wittestrasse 30, Building F, 13509 Berlin.

Controller means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. Data processing in the use of apartment portals

We work together with various apartment portals, including Immobilienscout24, Immowelt, Immonet, Ebay Kleinanzeigen, Woledo, WG-Gesucht. If you submit a request to us via such a portal, the portal will send us the following personal data:

  • Name,
  • Email address,
  • Telephone number,
  • Data on the rental property,
  • Inquiry text where applicable.

We process this data solely for the purpose of answering your request. The legal basis for the data processing is Article 6 (1)(1)(a), (b) GDPR.

The data will be deleted within 3 months after answering the request if it is no longer needed (e.g. for the agreement of a viewing appointment). No disclosure to third parties is made.

3. Use of the website

3.1 SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as inquiries that you send to us as the site operator, this website uses an SSL or TLS encryption.   An encrypted connection is indicated by the browser's address bar changing from ?http://? to ?https://? and the lock icon in your browser bar. If SSL or TLS encryption is enabled, the data you send to us cannot be read by third parties.

3.2 Data collection on our website

If you visit our website without using the service offered by us and without providing us with personal data, we may automatically collect the following information about you in so-called server log files. This information may, under limited circumstances, include personal information. Your browser automatically sends the following information to us:

  • Browser type and browser version,
  • Operating system used,
  • Referrer URL,
  • Host name of the accessing computer,
  • Time of service request, and
  • IP address.

This information is needed to enable the use of our website, for example by adapting the website to the needs of your device. No merging of this data with other data sources is made.

The legal basis for the processing of personal data is Article 6 (1) (1) (b) GDPR, provided the data processing is necessary for the provision of our offer. The additional data processing is based on Article 6 (1) (1) (f) GDPR. We have a legitimate interest in ensuring the security and effective use of our website. We assume that the problem-free use of the website is in your interest as well.

The automatically collected personal data will be stored for 3 months and then promptly deleted.

3.3 Cookies

Some websites use so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies are small text files that are stored on your computer and saved by your browser. Cookies serve to make our offer more user-friendly, effective and secure.

Most of the cookies we use are so-called "session cookies." These cookies are required to enable the use of our website. We use the following session cookies on our website:

 Name of the cookie:       Description of the funktion:     
 Google Analytics  Distinction of users
 Facebook  Distinction of users

 

The session cookies are automatically deleted after the end of your visit.

You can set your browser so that you are informed of the setting of cookies and can allow cookies only in individual cases, can enable or generally exclude the acceptance of cookies for certain cases, and can enable the automatic deletion of cookies when closing your browser. Disabling cookies may limit the functionality of this website.

Cookies which are required to carry out the electronic communication process or to provide certain functions desired by you (e.g. tenant portal) are stored on the basis of Article 6 (1) (1) (b) GDPR. If cookies are used to improve the use of the website, the legal basis is Article 6 (1) (1) (f) GDPR. We have a legitimate interest in storing cookies for the technical error-free and optimized provision of our services.

Insofar as cookies other than those listed above are stored (e.g. cookies for the analysis of your surfing behavior), these are treated differently according to this Privacy Policy (see below).

3.4 Contact form

If you send us inquiries about renting or rental properties via the website based contact form, your details from the inquiry form, including the contact details you provided there, will be stored by us in order to process the request and in case of follow-up questions. We do not share this data with third parties without your consent.

The legal basis for the processing is Article 6 (1) (1) (b) GDPR. The personal data will be stored for a period of 3 months after completion of the request and then deleted.

3.5 Website-based tenant portal

The data entered upon registering for the tenant portal provided exclusively for our tenants (name, tenant number, address, email address, date of birth and any voluntarily provided telephone number as well as any voluntarily indicated preferred language) is utilized for the purpose of using the offer (Article 6 (1) (1) (b) GDPR). Users may be informed by email about offer or registration-related information, such as changes in the scope of the offer or technical circumstances. The collected data can be seen from the input mask during registration. This includes name, tenant number, address, email address and any voluntarily provided telephone number as well as any voluntarily indicated preferred language, as well as any text box filled in by users themselves.

This data is saved as soon as you use your user account. If you delete your user account, your data will also be deleted directly. Upon termination of the tenant portal access due to the termination of the tenancy, the data of the user account at the time of termination will also be deleted directly. Statutory retention obligations or the requirement to retain your personal data for legal action due to misconduct in the use of services or payment problems may result in us storing your personal information for a longer period of time.

4. Social media, plugins and tools

We use various social plugins as well as other tools on our website to improve the use of the website for you.

4.1 Social plugins using the "2-click solution"

So-called social plugins ("Plugins") of the social networks Facebook, Google+, Twitter, Instagram, Pinterest, XING and LinkedIn are used on our website. These services are provided by the companies Facebook Inc., Google Inc., Twitter Inc., Instagram Inc., Pinterest Europe Ltd., XING AG and LinkedIn Corporation ("Providers"). They can communicate with you via Plugins and collect information about your visit to our website. This processing is based on Article 6 (1) (1) (a), (f) GDPR. With this, we pursue our legitimate interest in enhancing your user experience and optimizing our services.

In order to enhance the protection of your data when visiting our website, the Plugins for Facebook, Google+, Twitter, Instagram, Pinterest, XING, LinkedIn are integrated into the website via a so-called "2-click solution." This integration ensures that when you visit a page of our website that contains such Plugins, no connection is established with the servers of Facebook, Google and Twitter yet. Only when you activate the Plugins and thus give your consent to the data transfer does your browser establish a direct connection to the servers of Google, Facebook or Twitter. The content of the respective Plugin is then transmitted directly from the Provider to your browser and integrated into the page. If you are already logged in to one of the social networks, the transmission for Facebook and Google+ is carried out without another window. On Twitter, a pop-up window appears where you can first edit the text of the tweet.

 

a. Facebook

Our website uses social plugins ("Plugins") of the social network facebook.com, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). The Plugins are marked with a white "f" on a tile. The list and appearance of the Facebook Social Plugin can be viewed here: https://developers.facebook.com/docs/plugins/.

If you activate the Facebook Plugin, the content of the Plugin will be sent directly from Facebook to your browser and be integrated into the website. We have no influence on the amount of data that Facebook collects with the help of this Plugin and therefore inform you according to our level of knowledge: https://www.facebook.com/help/186325668085084.

By integrating the Plugins, Facebook receives the information that a user has accessed the corresponding page of the offer. If the user is logged in to Facebook, Facebook can associate the visit with their Facebook account. If users interact with the Plugins, for example, by pressing the Like button or leaving a comment, the corresponding information is transmitted from your browser directly to Facebook and stored there. If a user is not a member of Facebook, there is still the possibility that Facebook will find out and save their IP address. According to Facebook, only an anonymized IP address is stored in Germany.

The data processing takes place on the basis of your consent (Article 6 (1) (1) (a) GDPR). In addition, the use takes place in the interest of an attractive presentation and simplification of the use of our online offerings. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the related rights and setting options for protecting the privacy of users, can be found in Facebook's privacy policy: https://www.facebook.com/about/privacy/.

If a user is a Facebook member and does not want Facebook to collect data about them via this offer and associate it with their member data stored on Facebook, they must log out of Facebook before visiting the website.

 

b. Google+

Our website uses the "+1" button of the Provider Google+ of the company Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter "Google."

Each time you visit our website which has such a "+1" component, this component causes the browser you are using to download a corresponding representation of the component from Google if you have activated the Plugin. Through this process, Google is informed of which specific page of our website is currently being visited. According to the information provided by Google, there is no further evaluation of your visit unless you are logged in to your Google Account.

When you visit our website while you are logged into Google, Google may collect information about your Google Account, the website you recommend as well as your IP address and other browser-related information when you activate the "+1" button. Thus, your "+1" recommendation can be saved and made public. Your Google "+1" recommendation can then be shown as a reference along with your account name and, if applicable, your photo stored on Google in Google services, such as in search results or in your Google Account or elsewhere, such as on websites and ads on the Internet. In addition, Google may link your visit to our website to your data stored by Google. Google also records this information to further improve Google's services.

Therefore, if you wish to prevent the aforementioned collection by Google in the best possible way, you should log out from your Google Account before visiting our website.

The data processing takes place on the basis of your consent (Article 6 (1) (1) (a) GDPR). In addition, the use takes place in the interest of an attractive presentation and simplification of the use of our online offerings. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

You can access Google's privacy policy on the "+1" button including all other information about Google's collection, disclosure and use of data, your related rights, and profile setting options here: https://developers.google.com/+/web/buttons-policy

 

c. Twitter

Features of the Twitter service are integrated on our website. These features are provided by Twitter Inc., Twitter, Inc. 1355 Market St, Suite 900, San Francisco, CA 94103, USA. By using Twitter and the "re-tweet" function, the websites you visit are linked to your Twitter account and shared with other users. This data is also transmitted to Twitter.

The data processing takes place on the basis of your consent (Article 6 (1) (1) (a) GDPR). In addition, the use takes place in the interest of an attractive presentation and simplification of the use of our online offerings. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

We point out that as the provider of the website, we have no knowledge of the content of the transmitted data and their use by Twitter. For more information, see the Twitter Privacy Policy at http://twitter.com/privacy.

You can change your privacy settings on Twitter in the account settings at http://twitter.com/account/settings.

 

d. Instagram

Features of the Instagram service are integrated on our website. These features are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025,USA. If you are logged in to your Instagram account, you can link the contents of our pages to your Instagram profile by clicking on the Instagram button. This allows Instagram to associate the visit to our pages with your user account. We point out that as the provider of the pages, we have no knowledge of the content of the transmitted data and their use by Instagram.

The data processing takes place on the basis of your consent (Article 6 (1) (1) (a) GDPR). In addition, the use of Instagram takes place in the interest of an attractive presentation and simplification of the use of our online offerings. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

For more information, see the Instagram Privacy Policy: http://instagram.com/about/legal/privacy/.

 

e. Pinterest

We use the service pinterest.com on our website. Pinterest.com is a service of Pinterest, Inc., 808 Brannan St, San Francisco, CA 94103, USA. Through the integrated "Pin it" button on our website, Pinterest receives the information that you have accessed the corresponding page of our website. If you are logged in to Pinterest, Pinterest can associate the visit to our page with your Pinterest account and thus link the data. The data transmitted by clicking on the "Pin it" button is saved by Pinterest. For more information about the purpose and scope of the data collection and the further processing and use of the data, as well as the related rights and setting options for protecting your privacy, see the Pinterest Privacy Notice, which is available at http://pinterest.com/about/privacy/.

To prevent Pinterest from associating your visit with your Pinterest account, you must log out of your Pinterest account before visiting our website.

The data processing takes place on the basis of your consent (Article 6 (1) (1) (a) GDPR). In addition, the use of Pinterest takes place in the interest of an attractive presentation and simplification of the use of our online offerings. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

 

f. XING

We use components of the network XING.com on our website. These components are a service of XING AG, Dammtorstrasse 29-32, 20354 Hamburg, Germany. This includes Plugins of the kununu service offered by XING AG. Each time you visit our website which has such a component, this component causes the browser you are using to download a corresponding representation of the component from XING.

The data processing takes place on the basis of your consent (Article 6 (1) (1) (a) GDPR). In addition, the use of XING takes place in the interest of an attractive presentation and simplification of the use of our online offerings. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

To the best of our knowledge, XING does not store any personal data of the user on the visit to our website. Likewise, XING does not store IP addresses. There is also no evaluation of the usage behavior via the use of cookies in connection with the "XING Share Button." For more information, see the privacy policy for the XING Share Button at: https://www.xing.com/app/share?op=data_protection

 

g. LinkedIn

We use components of the LinkedIn network on our website. LinkedIn is a service of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Each time you visit our website which has such a component, this component causes the browser you are using to download a corresponding representation of the component from LinkedIn.

Through this process, LinkedIn is informed which specific page of our website is currently being visited. If you click the LinkedIn "Recommend Button" while logged in to your LinkedIn account, you can link the contents of our pages to your LinkedIn profile. As a result, LinkedIn is able to associate your visit to our pages with your LinkedIn user account.

The data processing takes place on the basis of your consent (Article 6 (1) (1) (a) GDPR). In addition, the use of LinkedIn takes place in the interest of an attractive presentation and simplification of the use of our online offerings. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

We have no control over the data that LinkedIn collects or the extent of the data collected by LinkedIn. We also have no knowledge of the content of the data transmitted to LinkedIn. For details about LinkedIn's data collection as well as your rights and settings options, see the LinkedIn Privacy Policy. This policy can be found at http://www.linkedin.com/legal/privacy-policy

4.2 Other tools

a. Google Web Fonts

This website uses so-called web fonts provided by Google for the uniform representation of fonts. The Provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you call up a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly.

To do this, the browser you use must establish a connection to Google's servers. As a result, Google learns that our website has been accessed via your IP address. The use of Google Web Fonts takes place in the interest of a consistent and attractive presentation of our online offerings. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

If your browser does not support web fonts, a default font will be used by your computer.

For more information about Google Web Fonts, see https://developers.google.com/fonts/faq and Google's Privacy Policy: https://www.google.com/policies/privacy/.

 

b.Google Maps

This website uses the mapping service Google Maps via an API (application programming interface). The Provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use the features of Google Maps, it is necessary to save your IP address. This information is usually transmitted to and stored on a Google server in the United States. The provider of this website has no influence on this data transfer.

The use of Google Maps takes place in the interest of an attractive presentation of our online offerings and an easy findability of the locations we have indicated on the website. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

For more information on the handling of user data, see Google's Privacy Policy: https://www.google.com/intl/de/policies/privacy/.

5. Analysis tools and advertising

5.1 Overheat

This website uses overheat.de, a web analysis tool of the company »overheat UG (haftungsbeschränkt)« with registered office at Haus Alsbach 2, 51766 Engelskirchen, Germany. It is used to anonymously record interactions of randomly selected, individual visitors with the website. This creates a log of for example mouse movements and clicks, with the aim of identifying options for improvement of the respective webpage. In addition, information about the operating system, browsers, incoming and outgoing links, geographical origin, as well as the resolution and type of the device are evaluated for statistical purposes. This information is not personal and will not be shared with third parties by overheat.de. If you do not wish this to be recorded, you can disable it on all websites using overheat by setting the DoNotTrack header in your browser. Relevant information can be found on the following page: http://overheat.de/opt-out.html

The use of Overheat takes place in the interest of enhancing your user experience and optimizing our services. This constitutes a legitimate interest within the meaning of Article 6 (1) (1) (f) GDPR.

5.2 Google Analytics

This website uses functions of the web analytics service Google Analytics. The Provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We have entered into a contract data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Analytics uses so-called cookies (see above). The information generated by the cookie about your use of this website is generally transmitted to a Google server in the United States and stored there. The corresponding evaluation of your surfing behavior is made available to us in anonymized form.

We have activated the IP anonymization function on this website. As a result, your IP address is truncated by Google within member states of the European Union or other Contracting States to the Agreement on the European Economic Area prior to transmission to the United States. Only in exceptional cases the full IP address will be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and Internet usage to the website operator. The IP address transmitted by Google Analytics as part of Google Analytics will not be merged with other Google data.

In addition, Google is certified under the EU-US Privacy Shield and the Swiss-US Privacy Shield, thereby ensuring an appropriate level of data protection at Google in the United States.

Google Analytics cookies are stored on the basis of Article 6 (1) (1) (f) GDPR. We have a legitimate interest in analyzing user behavior in order to optimize both our web website and our advertising.

You can prevent the use of Google Analytics at any time, either by installing a Google Browser Plugin that will set an opt-out cookie, or through appropriate settings in your browser. For more information, visit https://tools.google.com/dlpage/gaoptout?hl=de and https://www.google.com/analytics/terms/de.htm.

For more information on the handling of user data at Google Analytics, see the Google Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=de.

5.3 Demographics in Google Analytics

This website uses the "Demographics" feature of Google Analytics. As a result, reports can be produced that contain statements on the age, gender and interests of the website visitors. This data comes from interest-based advertising of Google as well as visitor data from third-party providers. This data cannot be associated with a specific person. You can disable this feature at any time through the ad settings in your Google Account, or generally prohibit the collection of your data by Google Analytics as described in 5.2.

The legal basis is Article 6 (1) (1) (f) GDPR. We have a legitimate interest in analyzing user behavior in order to optimize both our web website and our advertising.

5.4 Google AdSense

This website uses Google AdSense, a service for integrating advertisements of Google Inc. ("Google"). The Provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google AdSense uses so-called "cookies" (see above). Google AdSense also uses so-called “web beacons” (invisible graphics). These web beacons can be used to evaluate information, such as visitor traffic on these pages.

The information generated by cookies and web beacons on the use of this website (including your IP address) and delivery of advertising formats is transmitted to and stored on a server of Google in United States. This information may be disclosed by Google to contractors of Google. However, Google will not merge your IP address with other data you have stored.

The use of AdSense cookies and web beacons are stored on the basis of Article 6 (1) (1) (f) GDPR. We have a legitimate interest in analyzing user behavior in order to optimize both our website and our advertising.

You can prevent the installation of cookies by setting your browser software accordingly. Please note, however, that in this case you may not be able to use all the features of this website to the full extent.

5.5 Google AdWords and Google Conversion Tracking

This website uses Google AdWords. AdWords is an online advertising program of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

As part of Google AdWords, we use so-called conversion tracking. When you click on an ad served by Google, a cookie (see above) will be set for conversion tracking. This cookie loses its validity after 30 days and is not used for the personal identification of users. If the user visits certain pages of this website and the cookie period of 30 days has not yet expired, Google and we can identify that the user has clicked on the ad and has been redirected to this page.

Each Google AdWords customer receives a different cookie. The cookies cannot be tracked through the websites of AdWords customers. The information gathered using the conversion cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. We learn the total number of users who clicked on our ad and were redirected to a page provided with a conversion tracking tag. However, we do not receive any information that can be used to personally identify users. If you do not want to participate in tracking, you can opt out of this by simply disabling the Google conversion tracking cookie in your Internet browser under user settings. You will then not be included in the conversion tracking statistics. For more information, visit https://support.google.com/ads/answer/7395996.

The legal basis is Article 6 (1) (1) (f) GDPR. We have a legitimate interest in analyzing user behavior in order to optimize both our website and our advertising.

For more information about Google AdWords and Google Conversion Tracking, see the Google Privacy Policy: https://www.google.com/policies/privacy/.

You can set your browser so that you are informed of the setting of cookies and can allow cookies only in individual cases, can limit or generally exclude the acceptance of cookies for certain cases, and can enable the automatic deletion of cookies when closing your browser. Disabling cookies may limit the functionality of this website.

6. Newsletter

With your email address and your name, you can subscribe to our newsletter if you agree to receive the newsletter. In the regular newsletter, we inform you about the company as well as current offers.

Similarly, the changes to your data stored with MailChimp (hereinafter explained in clause 6.1) will be logged. Further data is not collected. Upon registering for the newsletter, we store your IP address and the date of registration and confirmation. This storage serves solely as proof in the event that a third party misuses an email address and logs on without the knowledge of the person entitled to receive the newsletter.

The legal basis for this processing is Article 6 (1) (1) (a) GDPR as well as Section 7 (2) no. 3 and (3) of the German of the Federal Act against Unfair Competition (UWG). We will store your email address as long as you subscribe to our newsletter.

The service is carried out with the help of the so-called "double opt-in" procedure. You will receive an email with a link confirming that you are the owner of the email address and you want to be notified by our email service. If your subscription is not confirmed within 96 hours of requesting the confirmation email, your provided personal information will not be processed, but automatically deleted.

6.1 Unsubscribe from newsletter

You can unsubscribe from the newsletter by clicking on the link included in each newsletter or by sending a message to the above contact options. At the same time, this will delete your consent to the distribution via MailChimp, the statistical analyses and the use of the email service provider MailChimp.

The newsletter is distributed via MailChimp, a newsletter distribution platform of Rocket Science Group, LLC, 675 Ponce De Leon Ave Suite 5000, Atlanta, GA 30308, USA.

The email addresses of our newsletter recipients, as well as their other information described in this policy, are stored on the MailChimp servers in the United States. MailChimp uses this information to send and evaluate the newsletters on our behalf. Furthermore, MailChimp may, according to its own statements, use this data for the purpose of optimizing or improving its own services, for example for the technical optimization of the distribution and the presentation of newsletters or for economic purposes in order to determine the countries from which the recipients come. However, MailChimp does not use the data of our newsletter recipients to contact them directly or to share them with third parties.

We rely on the reliability and the IT and data security of MailChimp. MailChimp is certified under the EU-US Privacy Shield data protection agreement and has thus undertaken to comply with EU data protection requirements. Furthermore, we have entered into a data processing agreement with MailChimp. This is an agreement in which MailChimp undertakes to protect the data of our users, to process it in accordance with its privacy policy on our behalf and, in particular, not to disclose it to third parties. You can view the privacy policy of MailChimp here https://mailchimp.com/legal/privacy/.

The legal basis is Article 28 GDPR in conjunction with the contract processing agreement.

6.2 Statistical surveys and analyses

The newsletters contain a so-called web beacon (invisible graphics) which is retrieved from the MailChimp server when the newsletter is opened. During this retrieval, technical information is collected first, such as information about the browser and your system, as well as your IP address and time of the retrieval. This information is used to improve the technical performance of services based on the technical data or target audience and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times.

The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be associated with the individual newsletter recipients. However, it is neither our aim nor the aim of MailChimp to monitor individual users. Instead, the evaluations serve to identify the reading habits of our users and to adapt our content accordingly or to send different content according to the interests of our users.

Our legitimate interests form the legal basis for the implementation of the statistical surveys and analyses as well as the logging of the registration procedure in accordance with Article 6 (1) (1) (f) GDPR. Our interest is directed towards the provision of a user-friendly and secure newsletter system that both serves our business interests and is in line with the expectations of our users.

7. Press releases

We regularly send press releases with information on renovation projects, tenant promotions, local initiatives, etc. If you would like to receive these press releases, you can register by email using your contact details (name, email address and name of your company/institution/editorial department) at [email protected] We will then include you on the respective mailing list for relevant topics or locations.

The legal basis for this processing is Article 6 (1) (1) (a) GDPR. Your data will be stored until you unsubscribe from receiving the press releases. You can unsubscribe from receiving the press releases by notifying us at the above contact options at any time.

8. Processing of tenant and prospective tenant data

If you apply for an apartment offered by us, we will process the following personal data about you:

last name, first name, date of birth, address, telephone number, email address, income information, information on the assumption of costs by third parties, occupation, employer, information on residence requirements conflicting with the lease, information on financial circumstances (in particular, proceedings for the disclosure of assets, actions for eviction), information on pets, information on the type of use of the premises.

Furthermore, we process the following personal data about other persons who would move into the apartment upon conclusion of the lease agreement:

last name, first name, date of birth.

If we accept you as a tenant, we will process the following additional personal data:

account information, potential information on the rendering of payments by third parties, Schufa credit agency information, identity card/passport number, potentially information on supervision. 

8.1 Purpose of data processing

We process the personal data collected from you for the purpose of implementing the rental application process in order to decide on the granting of the apartment you are interested in renting. The data is used in particular to determine whether you come into consideration as a tenant. Furthermore, we use the data to contact you in case of follow-up questions and to inform you about the decision on the rental. If we accept you as a tenant, we use the data to prepare the lease agreement and to implement the tenancy. The legal basis for processing is Article 6 (1) (1) (b) GDPR.

We also use some of your data to send you greetings on special events (e.g. Christmas). The legal basis for the processing is Art. 6 (1) (1) (f) GDPR. We have a legitimate interest in maintaining the relationship with our tenants through appropriate attentions.

8.2 Disclosure to third parties

In some cases, some of the above data may need to be shared with third parties for the purposes outlined above. The categories of recipients include:

  • Owner of the rental property occupied by you,
  • other tenants within the administrative local unit of the apartment you live in,
  • Testing institutes for the performance of operating cost calculations;
  • Craftsmen, architects, engineers, and custodians for site inspections and/or performance of necessary repairs or comparable measures,
  • Service providers for maintenance and repair measures,
  • Insurance agencies in the event of damage,
  • Utility companies that provide electricity, oil, gas, heating, cable, and Internet, which supply the property with those utilities,
  • Financial service provider (e.g. banks)
  • Law firms,
  • Courts,
  • Authorities,
  • Job centers,
  • Security services.

The legal bases for the disclosure are Article 6 (1) (1) (b) GDPR or Article 28 GDPR in conjunction with data processing agreements. In some cases, it may be necessary to have some of your personal information available to other tenants in order to meet their claims against us (for example, sending out a general overview of ancillary cost in the event of a query of access for evidence). The legal basis is Article 6 (1) (1) (c) GDPR. The disclosure to law firms and courts is based on Article 6 (1) (1) (f) GDPR, because we have a legitimate interest in the enforcement of our claim or in representation against claims. The legal basis for the disclosure to security services is similarly Article 6 (1) (1) (f) GDPR. Our legitimate interest consists in securing our buildings.

8.3 SCHUFA

Furthermore, for the purposes of the creditworthiness check of the prospective tenant prior to the conclusion of the lease agreement, we transfer personal data collected on the basis of the contractual relationship for the application for this tenancy as well as data on non-contractual or fraudulent conduct to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden.

The legal bases of these disclosures are Article 6 (1) (1) (b) and Article 6 (1) (1) (f) GDPR. The legitimate interest consists in ensuring the solvency of our tenants.

SCHUFA processes data and also uses it for the purposes of profiling (scoring) in order to provide its contracting partners in the European Economic Area and in Switzerland and, where applicable, other third countries (provided there is a corresponding adequacy decision by the European Commission) with information on, inter alia, the creditworthiness of natural persons. Further information on the activities of SCHUFA can be viewed online at www.schufa.de/datenschutz.

8.4 Storage period

Once the rental application process has been completed and we have not chosen you as a tenant, the data will be deleted or destroyed three months after completing the rental application process. Same applies once you inform about that you refrain from the rental application process.

If a lease agreement is concluded, the data that we need to implement and perform the tenancy will be stored. All other personal data will be deleted within three months after you moved in. Statutory retention periods shall remain unaffected.

If the tenancy is terminated, your data will be stored in accordance with the statutory retention period. All data not required will be deleted after the completion of the lease agreement in the bookkeeping within three months.

9. Processing of employment applicant data

You can apply on our advertisements for employment in our company. We are responsible for the data processing in the application process. If you are applying specifically for a position with us, please use our website at https://karriere.grandcityproperty.de. For unsolicited applications please use https://karriere.grandcityproperty.de/Initiativstelle-de-f11.html.

In the context of the application your name, your contact details, your qualifications and any other data that you may submit to us with your application will be processed for employment purposes. The provision of personal data is required for the examination of the application and possibly the subsequent conclusion of an employment contract. Without information from personal data, an application cannot be considered. The indication of information marked as voluntary is not necessary for the consideration of the application.

Legal basis is Section 26 BDSG-2017 (New German Federal Data Protection Act). Voluntary information within the framework of your application is processed on the basis of Section 26 BDSG-2017 in conjunction with Article 6 (1) (1) (a) GDPR. If you are also interested in information about other jobs, your data will be processed in accordance Section 26 BDSG-2017 in conjunction with Article 6 (1) (1) (a) GDPR processed.

Your application documents including personal data will be passed on internally to the competent and decision-making employees. In addition, it is passed on to service providers, in particular for the provision, maintenance and care of IT systems. The legal basis in this respect is Section 26 BDSG-2017 in conjunction with the corresponding data processing agreements.

If the application process ends without entering into an employment, your data will be deleted within six months. If you are also interested in other positions, we will store your data for 12 months, unless you request the deletion of the data beforehand.

10. Processing of data of service providers and business partners

We process personal data of service providers and business partners and their employees. These data include the name, the contact details, names and contact details of the contact persons [if applicable. complete]. The purpose of the processing is the commissioning and monitoring of the respective agreed services. The legal basis is Article 6 (1) (1) (b) GDPR. If there is an obligation to process data for example for accounting or tax reasons, the legal basis is Article 6 (1) (1) (c) GDPR. Contact and contract data can be transmitted to other service providers, business partners, offices and authorities, if this is necessary for the execution of the contract or order. We also use service providers in the provision of services through order processing, in particular for the provision, maintenance and care of IT systems.

Personal information of our suppliers may be disclosed to contractors who assist us in providing our services, such as accounting and accounting software providers. The legal basis is Article 28 GDPR in connection with contract processing contracts. We have contractually bound these contractors to process your personal data only in accordance with our instructions and to the extent permitted by law. Furthermore, data may be transferred to business partners as well as to offices and authorities, if this is necessary for the execution of the contract or order. The legal basis in this respect is Article 6 (1) (1) (b) GDPR. Passing on is necessary for the execution of the contract. Otherwise, a smooth process cannot be guaranteed.

In addition, some of the data is passed on to lawyers. The legal basis in these cases is Article 6 (1) (1) (f) GDPR. We have a legitimate interest in enforcing outstanding claims.

If the contract is terminated, your data will be stored in accordance with the statutory retention period. All data not required will be deleted after the completion of bookkeeping within three months.

11. Data protection rights

You have the following data protection rights, depending on the circumstances of the specific case:

11.1 Information

You have the right to request information about and access to your personal data and/or copies of such data. This includes information on the purpose of the use, the category of data used, its recipients and parties entitled to access it and, if possible, the planned period for which the data will be stored or, if that is not possible, the criteria used to determine these periods.

11.2 Refusal or revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You may refuse consent or revoke your previously granted consent at any time. An informal communication to us via email is sufficient for this purpose. The legality of the data processing carried out until the revocation shall remain unaffected by the revocation.

11.3 Right to lodge a complaint with the competent supervisory authority

If you believe that your rights have been violated as a result of your personal data being processed in a manner that is not in compliance with data protection laws, you have a right to lodge a complaint with the competent supervisory authority.

11.4 Right to data portability

You have the right to have the data that you have provided to us submitted to you or to a third party in a standard, machine-readable format. If you require the direct transfer of data to another controller, this will be done to the extent technically feasible.

11.5 Automated decision-making including profiling

You have the right not to be subjected to a decision based solely on automated processing that will have a legally binding effect on you or a significant adverse effect on you in a similar manner.

11.6 Blocking, deletion

Right to objectYou have a right to the rectification, blocking or deletion of your personal data, to the extent the use thereof is inadmissible under data protection law. This is the case in particular if (i) the data is incomplete or incorrect, (ii) it is no longer necessary for the purposes for which it was collected, (iii) the consent on which the processing was based has been revoked or (iv) you have successfully exercised your right to object to the data processing. In cases where the data is processed by third parties, we will forward your requests for rectification, deletion or restriction of processing to these third parties, unless this proves impossible or is associated with disproportionate efforts.

11. 7 Contradictory legal

You have the right to object to the processing if we process your data for direct marketing purposes or if we process your data for the purpose of pursuing our legitimate interests and there are reasons arising from your particular situation.

12. Miscellaneous

We reserve the right to change this Privacy Policy at any time in accordance with the data protection regulations.

For questions, suggestions and comments on the topic of data protection, please feel free to contact our data protection officer.

Contact: [email protected]