Privacy Policy

In the following, we inform you about the collection of personal data when using our website as well as when contacting us via a contact form, email, or telephone. Personal data is all data that can be personally related to you, e.g., name, address, email addresses, user behavior.

I. NAME AND CONTACT DETAILS OF THE CONTROLLER AND DATA PROTECTION OFFICER

1. The controller according to Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is Jens Heider, Schützenplatz 3 in 01067 Dresden, 0351 5634880, info@hbhimmobilien.de (see imprint www.hbhimmobilien.de/impressum).

2. You can reach our Data Protection Officer, Attorney Christian Krösch, SLK Compliance Services GmbH, Königsbrücker Straße 76, 01099 Dresden by phone: 0351 89676360 or email: datenschutz@slk-compliance.de.

II. GENERAL INFORMATION ABOUT THE COLLECTION, TRANSFER, AND STORAGE DURATION OF PERSONAL DATA

1. We process your personal data in compliance with the provisions of the GDPR, the Federal Data Protection Act (BDSG), and all other relevant laws.

2. The data processing primarily serves to establish and fulfill a contractual relationship with you. When you contact us by email, via a contact form, or by telephone, the data you provide (your email address, if applicable your name and telephone number) will be stored by us to answer your questions. The primary legal basis for this is Art. 6 para. 1 b) GDPR. In addition, your separate consent according to Art. 6 para. 1 a), 7 GDPR may be used as a data protection permission regulation. We also process your data to fulfill our legal obligations, particularly in the area of commercial and tax law. This is done on the basis of Art. 6 para. 1 c) GDPR. If necessary, we also process your data on the basis of Art. 6 para. 1 f) GDPR to safeguard legitimate interests of us or third parties.

3. Your personal data will not be transferred to third parties for purposes other than those listed below. We only pass on your personal data to third parties if you have given your express consent pursuant to Art. 6 para. 1 lit. a) GDPR, the disclosure is necessary pursuant to Art. 6 para. 1 lit. f) GDPR for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data, in the event that there is a legal obligation for the disclosure pursuant to Art. 6 para. 1 lit. c) GDPR, and this is legally permissible and necessary pursuant to Art. 6 para. 1 lit. b) GDPR for the processing of contractual relationships with you.

4. If we use contracted service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail about the respective processes below. There we will also name the defined criteria for the storage duration.

5. We delete your personal data as soon as they are no longer required for the following purposes. After termination of the contractual relationship, your personal data will be stored as long as we are legally obliged to do so. This regularly results from legal proof and retention obligations, which are regulated, among other things, in the Commercial Code and the Tax Code. The storage periods are then up to ten years. In addition, it may happen that personal data are stored for the period during which claims can be asserted against us (statutory limitation period of three or up to thirty years).

III. COLLECTION OF PERSONAL DATA ON OUR WEBSITE

1. VISITING OUR WEBSITE

1.1 When using the website for informational purposes only, i.e., if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect data that is technically necessary for us to display our website to you and to ensure stability and security.

1.2 The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f) GDPR.

1.3 The temporary storage of the IP address by the system is necessary to enable delivery of the website to your browser. For this purpose, your IP address must remain stored for the duration of the session. Storage in log files is carried out to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. These purposes also constitute our legitimate interest in data processing according to Art. 6 Para. 1 lit. f) GDPR. An evaluation of the data for marketing purposes does not take place in this context.

1.4 The data is deleted as soon as it is no longer necessary for achieving the purpose of its collection. In the case of collecting data for providing the website, this is the case when the respective session is ended.

1.5 The collection of data when visiting the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for you to object.

2. ADDITIONAL FUNCTIONS AND OFFERS ON OUR WEBSITE

2.1 In addition to the purely informational use of our website, we offer various services that you can use if interested. To do this, you will generally need to provide additional personal data that we use to provide the respective service and for which the aforementioned principles for data processing apply.

2.2 In some cases, we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions, and are regularly monitored.

2.3 If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you about the consequences of this circumstance in the description of the offer.

3. USE OF CONTACT FORMS

3.1 We collect your personal data if you voluntarily provide it to us via our contact forms. In this case, we record the information that is generated during the contact process. This includes, in particular, names and transmitted contact details, date, and reason for contact. The personal data collected from you will only be used to provide you with the desired products or services and to correspond with you (legal basis Art. 6 Para. 1 b) GDPR).

3.2 The data is deleted as soon as it is no longer necessary for achieving the purpose of its collection. For the personal data from the input mask of the contact form, this is the case when the respective conversation with you is ended. The conversation is considered ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. Insofar as the communicated data is subject to tax and commercial law retention obligations, it will be stored for the duration of the retention obligations of ten years and then deleted, unless you have consented to further storage or the further processing of the data is necessary for the assertion, exercise or defense of legal claims (statutory limitation period of three or up to thirty years).

4. DATA SECURITY

4.1 Within the website visit, we use the widespread SSL procedure (Secure Socket Layer) in conjunction with the highest level of encryption supported by your browser. As a rule, this is a 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can recognize whether an individual page of our website is transmitted in encrypted form by the closed representation of the key or lock symbol in the lower status bar of your browser.

4.2 We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

IV. COLLECTION OF PERSONAL DATA DURING CONTACT BY EMAIL, MAIL, AND TELEPHONE

1. COLLECTION OF PERSONAL DATA FROM CUSTOMERS, INTERESTED PARTIES, AND SUPPLIERS

1.1 We collect your personal data as a customer, interested party, or supplier only if you provide it to us voluntarily via email, post, or telephone. In this case, we record the information that is provided during the contact. This includes, in particular, names and transmitted contact details, date, and reason for contact. The personal data collected from you will only be used to provide you with the desired products or services (legal basis Art. 6 para. 1 b) GDPR), or for other purposes for which you have given your consent (legal basis Art. 6 para. 1 a) GDPR) and which are described in this privacy policy. You have the right to withdraw your consent to the processing of personal data at any time.

1.2 You are not obligated to provide the aforementioned personal data. The data provided may be necessary for the conclusion of a contract. Without the provision of the data, communication, contract conclusion, or contract processing may not be possible.

1.3 A transfer of the relevant data in each individual case takes place on the basis of legal provisions or a contractual agreement to public authorities in the presence of overriding legal regulations, to external service providers or other contractors, and to other external parties, insofar as you have given your consent or a transfer is permissible due to overriding interest. There is no intention to transfer your data to a recipient in a third country (non-EU/EEA member state) or an international organization.

1.4 The data will be deleted as soon as it is no longer necessary for achieving the purpose of its collection. For the personal data provided, this is the case when the respective conversation with you has ended. The conversation is considered ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. If the data provided is subject to tax and commercial law retention obligations, it will be stored for the duration of the retention obligations of ten years and then deleted, unless you have consented to storage beyond this period or further processing of the data is necessary for the assertion, exercise, or defense of legal claims. The legal basis for the processing

of personal data for the purposes of fulfilling statutory archiving and retention obligations is Art. 6 para. 1 s. 1 lit. c) GDPR.

2. COLLECTION OF PERSONAL DATA FROM APPLICANTS

2.1 We collect your personal data as an applicant only if you provide it to us voluntarily via email, post, or telephone. This applies to applications for job postings as well as unsolicited applications. In this case, we record the information provided during the application process. This includes, in particular, name, date of birth, contact details, interests, qualification data, as well as educational and professional backgrounds. The personal data collected from you will only be used for the purpose of conducting the application process (legal basis Art. 6 para. 1 lit. a), b) and f) GDPR, § 26 BDSG).

2.2 You are not obligated to provide the aforementioned personal data. The data provided may be necessary for a future contract conclusion after the completion of the application process. Without the provision of the data, communication, the conduct of the application process, or a contract conclusion may not be possible.

2.3 A transfer of the relevant data in each individual case takes place on the basis of legal provisions or a contractual agreement. Data is transferred to employees of the HR department, management employees, and the respective department head. Your personal data will not be transferred to third parties. There is no intention to transfer your data to a recipient in a third country (non-EU/EEA member state) or an international organization.

2.4 The data will be deleted as soon as it is no longer necessary for achieving the purpose of its collection. Therefore, after conducting the application process, in case of rejection, we retain your data for six months after notifying you of the rejection decision. If you have consented to longer storage, the storage period is two years. After this, we will either delete your data or request your consent again. You have the right to withdraw your consent to the processing of personal data at any time.

V. GOOGLE ANALYTICS

1. This website uses Google Analytics, a web analytics service provided by Google Inc. (‘Google’). Google Analytics uses ‘cookies’, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. In case of activation of IP anonymization on this website, your IP address will be truncated within member states of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity, and providing other services relating to website activity and internet usage to the website operator.

2. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.

3. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

4. This website uses Google Analytics with the extension ‘_anonymizeIp()’. This means that IP addresses are truncated before further processing, so that they cannot be directly associated with a specific individual. As far as the data collected about you is personal, it is therefore immediately excluded and the personal data is deleted immediately.

5. We use Google Analytics to analyze and regularly improve the use of our website. Through the statistics obtained, we can improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 para. 1 s. 1 lit. f GDPR.

6. Third party information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

7. Terms of use: https://www.google.com/analytics/terms/us.html, Overview of privacy policy: https://www.google.com/intl/en/analytics/learn/privacy.html, and the privacy policy: https://www.google.com/intl/en/policies/privacy.

Cookie Settings

VI. OBJECTION OR REVOCATION AGAINST THE PROCESSING OF YOUR DATA

1. If you have given consent for the processing of your data, you can revoke it at any time. Such a revocation influences the permissibility of processing your personal data after you have given it to us.

2. Insofar as we base the processing of your personal data on the balancing of interests, you may object to the processing. This is the case if the processing is not necessary in particular for the fulfillment of a contract with you, which is described by us in each case in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and will either discontinue or adapt the data processing or show you our compelling legitimate grounds on which we will continue the processing.

compelling legitimate grounds on which we continue the processing.

3. Of course, you may object to the processing of your personal data for advertising and data analysis purposes at any time. You can inform us about your advertising objection using the following contact details: HBH Immobilien GmbH, Schützenplatz 3 in 01067 Dresden, Tel: 0351 56 34 88 0, Fax: 0351 56 34 88 9, E-mail: datenschutz@hbhimmobilien.de

VII. YOUR RIGHTS

1. You have the right according to Art. 15 GDPR to request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage duration, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right to complain, the origin of your data, if not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful

information about their details.

2. According to Art. 16 GDPR, you can immediately request the correction of incorrect or completion of your personal data stored by us. You have the right according to Art. 17 GDPR to request the deletion of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims.

3. According to Art. 18 GDPR, you have the right to request the restriction of the processing of your personal data, as far as the accuracy of the data is disputed by you, the processing is unlawful, but you refuse their deletion and we no longer need the data, but you require them for the assertion, exercise or defense of legal claims or you have objected to the processing in accordance with Art. 21 GDPR.

4. You have the right according to Art. 20 GDPR to receive your personal data, which you have provided to us, in a structured, common and machine-readable format or to request the transfer to another controller.

5. According to Art. 7 Para. 3 GDPR, you have the right to revoke your once given consent to us at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future.

6. You also have the right according to Art. 77 GDPR to complain to a supervisory authority about the processing of your personal data by us, for example to the Saxon Data Protection Officer responsible for us, Bernhard-von-Lindenau-Platz 1, 01067 Dresden, Phone: 03 51 / 49 3-5401, E-mail: saechsdsb@slt.sachsen.de.

VIII. CURRENT STATUS AND AMENDMENT OF THIS PRIVACY POLICY

1. This privacy policy is currently valid and has the status of November 2020.

2. Due to the further development of our website and offers or due to changed legal or official requirements, it may become necessary to change this privacy policy. The current privacy policy can be viewed and printed by you at any time on the website at http://www.hbhimmobilien.de/datenschutz.html.