Controllers according to Article 4(7) GDPR and service providers according to Section 13 German Telemedia Act (TMG)

Depending on the project or service you are exploring on this website or the service you are using, the data processing explained below will be carried out by Investa Holding GmbH, Investa Development GmbH, Investa Capital Management GmbH, Investa Asset Management GmbH, Investa Projektentwicklungs- und Verwaltungsgesellschaft mbH or e-shelter security GmbH. You can find more details about these companies in the legal notice. This website is the online corporate presence of the Investa Real Estate group and contains information about individual projects, offerings and services provided by the company concerned.

For data protection requests, please contact

Investa Real Estate Datenschutz-Team
Düsseldorfer Strasse 15
65760 Eschborn
Email: datenschutzteam@investa.de

Any requests regarding data subjects – in particular exercising the rights of data subjects – will be forwarded internally to the controller responsible for the processing in question. The website operators have concluded relevant data protection agreements with one another in order to regulate their joint responsibility.

Data protection officers

Investa Real Estate and the individual companies referred to above have appointed data protection officers. If you have any questions about data protection, you can contact our data protection officer and data protection team at:

Investa Real Estate Datenschutz-Team

– An den Datenschutzbeauftragten –

Düsseldorfer Strasse 15
65760 Eschborn

Email: datenschutz@investa.de

1. General

We process personal data that we obtain from you during your visit to our website or when you contact us via email or using a contact form.

If you are visiting or using our website for informational purposes only – that is, if you do not register as a user or send information to us in any other way – we will only collect the personal information that your browser transmits to our server. If you wish to view our website, we will collect the data the following data that is technically required to display our website and maintain its stability and security:

• Your IP address (network address)
• The date, time and duration of your visit
• The addresses of the pages you visit (URLs)
• The access status/http status code
• The quantity of data transferred
• The website from which the request was sent
• The browser you used
• The operating system and browser version on your device (user agent)

In the first instance, collecting data only means that the website server becomes aware of the data. As a rule, we do not store the data at this point. However, some of the data listed above (such as the IP address) will be stored in log files at random. The IP address will be logged in justified cases in order to prevent misuse and attacks on the website (such as denial-of-service attacks).

2. Purposes for which personal data needs to be processed and legal bases for processing

When processing your personal data, we comply with applicable statutory data protection regulations. Depending on the purpose, the legal bases for data processing on our website are as follows:

Consent (Article 6(1) (a) GDPR): Processing your personal data is lawful if you have provided your consent to the data processing for defined purposes (such as responding to your request or using data for marketing purposes). If we wish to use cookies or services that require consent on this website, they will only be activated once the website user has granted their consent via our consent management tool (cookie banner). Consent can be withdrawn at any time with future effect.

Statutory obligations (Article 6(1) (c) GDPR): These include retention regulations under trade and tax legislation in accordance with the German Commercial Code (Handelsgesetzbuch) and the Fiscal Code of Germany (Abgabenordnung), and fulfilment of monitoring and reporting obligations under tax legislation.

Legitimate interests (Article 6(1) (f) GDPR): Where necessary and permitted, the scope of processing your data extends beyond performing the contract itself to upholding our legitimate interests or those of third parties. Some examples of this are asserting legal claims and defense against lawsuits, maintaining IT security and IT operations, as well as analyzing and improving the use of our website.

3. Data recipients

We have some of the aforementioned processes and services performed by carefully selected service providers who are appointed in line with data protection requirements. In accordance with Article 28 GDPR, we have concluded relevant processing contracts with these external service providers. These contracts mean that the service providers are bound to our instructions and can be monitored regularly. Otherwise, data is not passed on to third parties and, in particular, is not sold for marketing purposes.

4. Transferring data to a third country or an international organization

Any processing that involves the use of services from external service providers takes place exclusively in line with statutory requirements. Subject to express consent or transfer required by contract or law, we only process or have data processed in third countries if the level of data protection is officially recognized as adequate, if contractual obligations based on standard contractual clauses as defined by the European Commission have been concluded, or if certification mechanisms or binding internal data protection regulations are in place (Articles 44 to 49 GDPR; European Commission information page: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en).

5. Storage duration/criteria for defining the duration for which personal data is to be stored

Personal data is stored in accordance with statutory data processing regulations and with statutory retention periods taken into account. We process your data exclusively for purposes that we are entitled to pursue and provided that the data is required for these purposes. If the data is no longer required for a given purpose or to fulfil statutory obligations, it will generally be erased unless it needs to be further processed – subject to time limits and other restrictions, where applicable – because of statutory obligations concerning retention or upholding our legitimate interest.

In addition to the data referred to above (see “Data processing during website use”), cookies will be created and stored on your device (smartphone, laptop, tablet, desktop PC, etc.) via your browser when you use our website. Cookies are primarily used to make it easier to navigate a website. Most importantly, some cookies are essential for ensuring that our website runs properly. The legal basis for technically necessary cookies is Article 6(1) (f) GDPR, i.e., safeguarding the legitimate interests of the operator of this website.

Cookies are not able to run programs or transfer viruses to your computer. Their purpose is to make the web presence more user-friendly and effective. The information they collect is stored separately from any other data we have obtained. We wish to note that cookie data is not linked to your other data.

In the case of cookies that are non-essential, you will be asked for your consent to the cookies being set.

Most browsers are configured in a way that enables them to accept cookies. However, you can deactivate cookies in your browser at any time or adjust your browser settings so that you receive a notification as soon as any cookies are sent. Please note that not all the website functions may work correctly if you do this.

Cookie banner (consent management tool for obtaining consent)

Separately from technically necessary cookies and services that we use without the consent of the website user, we may wish to use non-essential cookies or services subject to your consent in order to analyze the behavior of our website visitors in more detail for marketing purposes, for example, or in order to potentially use services from service providers outside the EU. Non-essential cookies or services only become active if the website user has explicitly granted their consent beforehand. We use what is known as a cookie banner as way of obtaining consent to use cookies and services that require consent on our website, working in accordance with data protection requirements. The cookie banner is provided through an external service provider, e.g., UserCentrics.

The cookie banner (consent management tool) is a means to obtain and store consent to the use of cookies in relation to the website user concerned. This ensures that non-essential cookies (i.e., cookies that are not technically necessary), especially those for marketing and analysis purposes, for example, are not set until the user has granted their explicit consent to their use.

We store information stating that the user has granted their consent to use non-essential cookies and services and stating the extent to which they have granted this consent. The user may withdraw their consent at any time by opening their cookie settings and managing their declaration of consent. The relevant cookies will be deleted once consent has been withdrawn. A cookie is also set in order to store information about the status of the user’s consent; reference is made to this in the cookie details. To allow the cookie banner and, therefore, the user’s consent to be managed, the IP address is neither stored nor combined with any other user data; it is only used to ensure the service runs correctly. Therefore, the use of data is based on our legitimate interest in ensuring that our web presence is legally compliant in accordance with Article 6(1) (f) GDPR.

Cookies that require consent

In addition to the purely informational purpose that our website serves, we offer services that you may use if interested. To benefit from these services, you will usually need to provide additional personal data that we will then use to provide the service in question; the aforementioned data processing principles also apply to this data.

Contact via email

If you contact us via email, we will store the data you provide (your email address and, where applicable, your name and phone number) in order to answer your questions. We will erase the data provided in this context once it is no longer necessary to store it, or we will restrict its processing if there are statutory retention obligations that we have to uphold.

Applications

We advertise current job openings on our website. Under “Data protection information” on the “Career” page of our website, you can find more detailed information about data processing in the context of the application process.

This website contains links to third-party websites and other websites under the responsibility of the website operator. When you follow a link to an external website (i.e., to a location outside our website), please note that this website will have its own responsibility for processing data and that we cannot assume any responsibility or liability for external content or online presences. Please read external providers’ data protection information concerning data processing carefully before you voluntarily provide personal data to these websites.

External links on this website are identified with the following icon: 

Links to Google Maps

For individual projects, we provide a hyperlink to directions in Google Maps. If you click on external links to Google Maps, your personal data will be processed directly by the third-party provider. Data that is processed may include, most notably, user UP addresses and location data. You can only view Google Maps in full if you consent to data processing for the purpose of displaying or fully using Google Maps via the provider, Google. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Website: https://cloud.google.com/maps-platform. Privacy Policy: https://policies.google.com/privacy

As a data subject, you have the following rights with respect to your personal data:

    The right to request access to your processed personal data in accordance with Article 15 GDPR. In particular, you may access information about the purposes of processing, the categories of the personal data concerned, the recipients to whom your data has been or will be disclosed and the envisaged period for which the data will be stored.

    The right to request immediate rectification of inaccurate personal data that has been stored or completion of this data.

    The right to request that your stored personal data is erased in accordance with Article 17 GDPR, provided that processing is not required in order to fulfil a statutory obligation or to assert, exercise or defend legal claims.

    The right to request that the processing of your personal data is restricted in accordance with Article 18 GDPR.

    The right to request portability of your personal data in accordance with Article 20 GDPR.

    The right to withdraw consent granted to the controller at any time after it has been granted, in accordance with Article 7(3) GDPR. This means that any data processing based on this consent will no longer be permitted to take place in the future.

    The right to lodge a complaint with a supervisory authority in accordance with Article 77 GDPR, without prejudice to any other administrative or judicial remedies. For this purpose, you can normally contact the supervisory authority for your usual place of residence, the location of your workplace or the location of the suspected infringement if you believe that the act of processing the personal data in question is in breach of the GDPR.

Asserting data subject rights

You may assert the aforementioned data subject rights in writing by sending physical correspondence to the relevant controller within the Investa Real Estate group or an email to datenschutzteam@investa.de. We recommend sending requests via email. The controller responsible for data processing will depend on the enquiry, project or type of service. The Investa Real Estate companies, as joint operators of this online presence in the form of this website, have concluded a data protection agreement and implemented policies for handling the rights of data subjects. This ensures that requests from data subjects are answered and attended to promptly and in accordance with statutory provisions.