Data protection information – processing applicant data

We take the protection of your personal data seriously and observe the provisions established under data protection legislation, particularly those set out in the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). This means that we only process your personal data if a statutory provision permits it, if doing so is necessary for executing and managing your application process, if we have a legitimate interest in processing the data, or if you have granted your consent. In this data protection information, we explain which information (including personal data) we process in connection with your application process and which data protection rights you have. Which specific data is processed and in what way will largely depend on how your application process is executed and managed.



Depending on which job opening you are applying for and to which company, the data processing explained below will be carried out by Investa Holding GmbH, Investa Development GmbH, Investa Capital Management GmbH, Investa Asset Management GmbH, Investa Projektentwicklungs- und Verwaltungsgesellschaft mbH or e-shelter security GmbH. You can find more details about these companies in the legal notice. This website is the online corporate presence of the Investa Real Estate group and contains information about individual projects, offerings and services provided by the company concerned.

For data protection requests, please contact

Investa Real Estate Datenschutz-Team
Düsseldorfer Strasse 15
65760 Eschborn

Any requests regarding data subjects – in particular, exercising the rights of data subjects – will be forwarded internally to the controller responsible for the processing in question. The website operators have concluded relevant data protection agreements with one another in order to regulate their joint responsibility.

Data protection officers
Investa Real Estate and the individual companies referred to above have appointed data protection officers. If you have any questions about data protection, you can contact our data protection officer and data protection team at:
Investa Real Estate Datenschutz-Team
– An den Datenschutzbeauftragten –
Düsseldorfer Strasse 15
65760 Eschborn

Data protection requests to e-shelter security services GmbH & Co. KG

e-shelter security services GmbH & Co. KG
Eschborner Landstrasse 100
60489 Frankfurt am Main, Germany



In order to execute your application process, we need to process the following personal data:

  1. Master data: We process basic information about you and the circumstances of your application. We refer to this data collectively as “master data”. In particular, it includes any information that you have communicated to us or we have requested from you as part of the application process (such as your name, address, phone number, email address, date of birth, marital status, nationality, religious denomination, education, career background and photo).



  1. We process your data in accordance with Article 6(1) (b) GDPR (steps prior to entering into a contract), combined with Article 88 GDPR and Section 26 BDSG concerning employment decisions. The purposes of data processing are primarily based on the application process. Data is mainly processed in order to:
    a) execute application processes; or
    b) fulfil existing obligations arising from legislation, regulations, company agreements and individual contractual provisions.
  2. We may also process your personal data in order to fulfil legal obligations to which we are subject in accordance with Article 6(1) (c) GDPR. In particular, these legal obligations include our mandatory requirements for reporting to social security agencies and authorities (including tax authorities), retention regulations under employment, tax and social security legislation, and retention requirements under trade and tax legislation in accordance with the German Commercial Code (Handelsgesetzbuch) and the Fiscal Code of Germany (Abgabenordnung).
  3. Where necessary, we process your data – beyond the scope of executing the application process and fulfilling legal obligations – to safeguard our legitimate interests or the legitimate interests of third parties in accordance with Article 6(1) (f) GDPR. Our legitimate interests include:
    a) Asserting legal claims and defense against lawsuits;
    b) Preventing and resolving offenses;
    c) Safeguarding the security of the IT systems we use; and
    d) Pursuing information-logging and communication purposes in business contexts.
  4. If the data categories referred to in II above include special types of personal data (such as health-related data), we process this data in order to fulfil our obligations arising from employment legislation and social security legislation to the extent provided for by law; this processing is based on Article 9(2) (b) GDPR.
  5. In accordance with Article 6(1) (a), processing personal data is deemed lawful when the data subject has given consent for specific purposes (such as storing data in the group’s pools of applicants or retention of data after the application process).

Please be aware that:

  • consent is always granted to us on a voluntary basis and neither granting nor withdrawing consent will have negative consequences for your application process;
  • not granting consent or withdrawing consent may however have other consequences that we inform you about before you grant consent; and
  • you may withdraw consent granted to us at any time with future effect; for example, by notifying us by post, fax or email using one of the contacts listed on the first page of this data protection information.



The personal data referred to in II above must be provided so that we can execute and manage your application process, unless otherwise explicitly specified by us when this data is being collected. Without this data we cannot execute your application process. If we collect personal data from you beyond this scope, we will communicate to you whether providing this information is required by law or contract, or is required for your application process. In doing so, we usually identify information that is provided voluntarily and not required to fulfill any of the aforementioned obligations or to conclude a contract.



As a rule, your personal data is processed within our company. Only specific departments and organizational units are given access to your personal data, based on the type of personal data concerned. In particular, these include the HR department, your potential supervisor(s) and – in the case of data received via the IT infrastructure – the IT department to a certain extent. We have a roles and authorization concept in place to ensure that access within our company is restricted to the roles and scope necessary for the processing purpose in question. To the extent permitted by law, we may also transfer your personal data to third parties outside our company. These external recipients may include, in particular:

  • affiliated companies within the Investa Real Estate group, to which we transfer personal data for internal administrative processes, in particular, for executing application processes within those companies; or
  • service providers we engage – which, on the basis of separate contracts, provide services that may include processing personal data – and service provider subcontractors, which are engaged with our consent. Our service providers are carefully selected by us and appointed in line with data protection requirements.

With regard to passing data on to other recipients, we are only permitted to pass on your data if required by law, if you have granted your consent or if we are authorized to do so. Other parties may also receive data if you have granted us your consent to transfer data.



As a rule, we do not use any automated decision-making (including profiling) as defined by Article 22 GDPR in order to execute or in the course of the application process. However, if we decide to use processes of this kind in isolated cases, we will notify you separately to the extent required by law.



Your personal data is processed exclusively within the EU or European Economic Area and is not transferred to other countries (third countries).



The criteria for defining the storage duration are determined on the basis of the purpose and any subsequent statutory retention periods. As a rule, we store your personal data if we have a legitimate interest in doing so and provided that your interests do not outweigh the interests in continuing to store the data. Even without a legitimate interest, we may continue to store data if we are legally required to do so (in order to fulfil retention obligations, for example). We will erase your personal data without your intervention as soon as it is no longer required to fulfil the purpose of processing or storing it would not otherwise be permitted by law. Personal data is normally stored until at least the end of the application process. Data will be erased no later than the point at which the purpose of storing it has been achieved. Where applicable, this may not take place until after the application process is complete. Personal data that we need to store in order to meet retention obligations will be stored until the end of the retention obligation in question. If we store personal data exclusively for the purpose of fulfilling retention obligations, the data will be blocked in a way that ensures it can only be accessed if required for the purpose of the retention obligation. Retention obligations may refer to:

  • fulfilling retention obligations under employment, social security, trade and tax legislation; specifically, the German Commercial Code (Handelsgesetzbuch) and the Fiscal Code of Germany (Abgabenordnung). These specify retention and documentation periods of up to 10 years.



  1. As a data subject, you have the right to:
  • access your stored personal data in accordance with Article 15 GDPR;
  • have inaccurate or incomplete data rectified in accordance with Article 16 GDPR;
  • have personal data erased in accordance with Article 17 GDPR;
  • have processing restricted in accordance with Article 18 GDPR;
  • data portability in accordance with Article 20 GDPR; and
  • object to the processing of your personal data in accordance with Article 21 GDPR.

Where the right to access and erasure is concerned, the restrictions apply in accordance with Section 35 BDSG. To exercise these rights, you can contact us at any time using one of contacts stated at the beginning of this data protection information, for example. If you have any questions about how your data is processed, you can also contact our data protection officer.

2. In addition, you are entitled to lodge complaints with the relevant supervisory authority for data protection in accordance with Article 77 GDPR.



You may assert the data subject rights referred to in IX.1 above in writing by sending physical correspondence to the relevant controller within the Investa Real Estate group or an email to We recommend sending requests via email. The controller responsible for data processing depends on the job in question and the person to whom you have sent your application. The Investa Real Estate companies, as joint operators of this online presence in the form of this website, have concluded a data protection agreement and implemented policies for handling the rights of data subjects. This ensures that requests from data subjects are answered and attended to promptly and in accordance with statutory provisions.