Data Privacy Policy of Grossmann & Berger GmbH


(English Version of 4 June based on German version as of 25 May 2018)

 
Modern information and communications technologies play an ever bigger role in the activities of companies like Grossmann & Berger GmbH. For this reason, we take very seriously the protection of your privacy and the personal data which you provide to us. We observe as a matter of course the legal provisions designed to protect data privacy, in particular those contained in the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), and the German Telemedia Act (Telemediengesetz, TMG).
 

I. Name and Address of the Controller

The company controlling the processing of your data (“Controller”) within the meaning of the General Data Protection Regulation, national data protection laws promulgated by the EU Member States, and any other provisions of law pertaining to the protection of data privacy is:
 
Grossmann & Berger GmbH
Bleichenbrücke 9 (Stadthöfe)
D - 20354 Hamburg
Telephone: +49 (0)40 / 350 80 2 - 0
Telefax: +49 (0)40 / 350 80 2 - 36
E-Mail: info@grossmann-berger.de
Internet: www.grossmann-berger.de
 

II. Name and Address of the Data Protection Officer

The data protection officer appointed by the Controller is:
 
Thies Petersen
Data Protection Officer
Hamburger Sparkasse
P.O. Box
20454 Hamburg
E-Mail: datenschutz@haspa.de
 
Our Data Protection Officer is available to you, as user, to answer any questions you may have about the processing of your personal data or the protection of data privacy more generally, as well as in the event you wish to file a complaint.
 

III. General Considerations on the Processing of Data

1. Scope of our processing of personal data

We collect and use the personal data of our users in general only to the extent that doing so is necessary to make available to you a well-functioning website, provide you with content, or perform certain services. In most cases, we collect and use personal data only after obtaining the consent of our users. An exception applies where circumstances make obtaining the prior consent of users impossible and the processing of data is permitted pursuant to the applicable statutory provisions. 
 

2. Legal Basis for the processing of personal data

To the extent we obtain the consent of the data subject for any step in the processing of personal data, Art. 6 Para. 1 lit. a GDPR serves as the legal basis for our processing of personal data.
 
In the event that the processing of personal data is necessary to fulfil an agreement to which the data subject is a party, Art. 6 Para. 1 lit. b GDPR serves as the legal basis for so doing. This also applies to steps in the processing of data which are necessary for the execution of pre-contractual measures.
 
To the extent the processing of personal data is necessary to perform a legal obligation to which our company is subject, Art. 6 Para. 1 lit. c GDPR serves as the legal basis for so doing.
 
In the event that measures performed in the public interest make it necessary to process personal data, Art. 6 Para. 1 lit. e GDPR serves as the legal basis for so doing.
 
Where the processing of personal data is necessary to protect the legitimate interests of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not outweigh the legitimate interests of our company, Art. 6 Para. 1 lit. f GDPR serves as the legal basis for such processing. 
 

3. Erasure of data and term of storage

The personal data we have stored relative to any data subject will be erased or blocked as soon as the purpose for which they were stored is no longer present. The data may, however, continue to be stored where European or national legislation, through regulation, law, or other provisions to which the Controller is subject, so requires. In such cases, the personal data will be blocked or erased once the data retention period has expired, provided there are no circumstances requiring the continued storage of such data for the purpose of concluding or fulfilling an agreement.
 

IV. Providing access to our Website and Creation of Log Files

1. Description and scope of our processing of data

Every time someone visits our Website, our system automatically collects data and information concerning the computer system used to access the site. 
 
The following data are collected:
(1) Information about the type and version of the browser used
(2) The user’s operating system
(3) Date and time of access
(4) Websites via which the user’s system came to our Website 
(5) Websites which the user’s system accesses via our Website
(6) The user’s IP-Address
(7) The page visited on our Website
 
These data are then also stored in the log files of our system. The log files store IP addresses and the date and time, so that it is possible to identify the user. These data are not stored together with other personal data relevant to the user.
 

2. Legal basis for the processing of data

The legal basis for our temporary storage of these data and the log files is Art. 6 Para. 1 lit. f GDPR.
 

3. Purpose of our processing of data

The temporary storage of the user’s IP address by our system is necessary to enable us to transmit our Website to the user’s computer. To this end, the user’s IP address must be stored for the duration of the session. 
 
The data are stored in the log files in order to ensure the functionality of the Website. In addition, these data help us optimize the Website and ensure the security of our information technology systems – in particular to help defend the system against attacks from hackers. No evaluation of the data for marketing purposes is conducted in this connection. 
 
These purposes also constitute our legitimate interest in the processing of user data pursuant to Art. 6 Para. 1 lit. f GDPR.
 

4. Term of storage

The data will be erased as soon as they are no longer needed to achieve the purpose for which they were stored. With respect to data collected in order to transmit our website to a user, this will be the case at the conclusion of the internet session. 
 
With respect to data stored in log files, this will be the case after a period of no longer than seven days. 
 

5. Objection or Erasure

The collection of data used for transmission of the Website and the storage of data in log files is absolutely necessary for operation of the Website. As a result, users have no way of objecting to such procedures.
 

V. Use of Cookies

1. Description and scope of our processing of data

Our Website uses cookies. Cookies are text data, which are stored in the internet browser or stored by the internet browser on the user’s computer system. Whenever a user calls up a web page, a cookie may be saved onto the user’s operating system. This cookie contains a characteristic series of signs, which makes it possible to identify the browser unambiguously when the Website is called up again. 
 
We use cookies to make our Website more user-friendly. Certain elements of our Website require that we be able to identify the browser used even after it has changed pages. The following data are stored and transmitted in the cookies in this connection:
(1) Marked objects (watch list)
(2) Sortation of your real estate search (listing date, price)
 
Our Website also uses cookies which make it possible to analyze the user’s surfing behavior. In this way, the following data may be transmitted:
(1) Search terms entered
(2) Frequency with which pages are visited
(3) Use of certain Website functions
(4) Frequency with which pages are visited (in particular drop rates, length of visit)
(5) Storage of selected events (e.g., contact requests, registration for our Newsletter)
(6) Source page from which you accessed our Website and external links you followed
(7) Search terms on our Website
 
The user data collected in this way are pseudonymized by technical processes. As a result, it is no longer possible to relate the data to the user who visited our Website. These data are not stored together with other personal data of the user.
 
Whenever a user visits our Website, a banner informs him about our use of cookies for analytical purposes and refers him to this Data Privacy Policy. In connection herewith, we also explain how the user can block the storage of cookies in his browser settings.
 

2. Legal basis for the processing of data

The legal basis for our processing of personal data using cookies is Art. 6 Para. 1 lit. f GDPR.
 

3. Purpose of our processing of data

The purpose for using technically required cookies is to simplify the use of Websites for the user and shorten URLs. Certain functions of our Website cannot be offered without the use of cookies. For these functions, it is necessary that the browser be recognized even after it has switched pages within the Website and during the same session.
 
We need cookies for the following applications:
(1) Marking sortation parameters in the list of real estate search results (such as sortation according to listing date or price)
(2) Marking selected properties for your watch list
 
The user data collected by technically required cookies are not used to create user profiles. 
 
We use analysis cookies for the purpose of improving the quality of our Website and enhancing its content. Through the analysis of cookies, we learn how our Website is being used so that we can constantly optimize our offerings.
 
 
These purposes also constitute our legitimate interest in the processing of user data pursuant to Art. 6 Para. 1 lit. f GDPR.
 

4. Term of storage, objection and deletion

Cookies are stored on the computer of the user and are transmitted from there to our Website. Thus, you as user have full control over the use of cookies. By changing the settings on your internet browser, you can deactivate or restrict the use of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our Website, it is possible that some of the functions of our Website can no longer be used in full. 
 
The cookies are stored in part only until the end of the session (so-called session cookies) and in part long-term, but never for longer than 26 months after your last visit to our Website. 
 

5. Google Analytics

This Website uses Google Analytics, an internet analysis service offered by Google Inc. („Google“). Google Analytics uses so-called "cookies," or text data, which are stored on your computer and make it possible to analyze your use of our Website. The information concerning your use of this Website generated by the cookie (including your anonymized IP address) is transmitted to Google’s server in the USA and saved there. Google will use this information to evaluate the use of our Website, to generate reports on Website activities for the Website operator, and provide other services connected with the use of our Website and the internet. Google, too, may in turn pass this information on to third parties, to the extent this is provided for by law or third parties process this information on behalf of Google. Google will in no event connect your anonymized IP address with other data that may be stored by Google. You can prevent the installation of these cookies by making a corresponding change to the settings on your browser software; we point out, however, that in this case you may not be able to make full use of all the functions offered by this Website. You can, moreover, block Google’s storage and processing of the data generated by the cookie and relating to your use of the Website (including your IP address) by downloading and installing the browser-plugin available through the following link: Google Opt out. As an alternative to the Browser-Add-On, or when using a browser on a mobile device, you can click on the following link:
This will install an opt-out-cookie on your device which prevents the future collection of your data by Google Analytics when you visit this Website. The opt-out functions only in the Browser and only for this domain. If you delete the cookies in your browser, you must click on this link again. 
 
You will find more information on the terms of use and data protection at Terms of Use – Analytics or at https://policies.google.com/?hl=en.
We point out that, on this Website, Google Analytics was enhanced by the Code "anonymizelp," in order to ensure that IP addresses are stored anonymously (so-called IP-masking).
 

VI. Newsletter

1. Description and scope of our processing of data

On our Website, it is possible for you to subscribe to our free Newsletter. If you do so, the following data from the entry form will be transmitted to us in connection with your registration for the Newsletter: 
 
(1) Subjects of interest
(2) Term of address
(3) Title
(4) First name
(5) Surname
(6) E-Mail address. 
 
In addition, the following data will be collected in connection with your registration: date and time of registration.
 
In connection with the registration procedure, we shall request your consent to our processing of these data and refer to this Data Protection Policy.
 
No data are passed on to third parties in connection with our processing of data in connection with the delivery of our Newsletter. The data are used exclusively for the purpose of sending out the Newsletter.
 

2. Legal basis for the processing of data

The legal basis for the processing of data following the user’s registration for our Newsletter is, where the user has consented thereto, Art. 6 Para. 1 lit. a GDPR.
 

3. Purpose of our processing of data

Storage of the user’s e-mail address enables us to deliver the Newsletter. The storage of other personal data in connection with the registration process serves to prevent abuses of our services or of the e-mail address used.
 

4. Term of storage

The data will be erased as soon as they are no longer needed to achieve the purpose for which they were stored. This will be the case when you signal to us, by clicking on the unsubscribe link provided with every Newsletter, that you are no longer interested in receiving our Newsletter. The user’s e-mail address will thus be stored only so long as his subscription to the Newsletter is active. Following a successful cancellation of your Newsletter subscription, your personal data will be erased after a period of seven days.
 

5. Objection and Erasure

The user in question can cancel his subscription to the Newsletter at any time. To this end, a corresponding link is included in every Newsletter. In this way, we also make it possible for the user to revoke his consent to storage of the personal data collected during the process of registration.
 

VII. Contact Form and E-mail Contact

1. Description and scope of our processing of data

There are contact forms available on our Website, which may be used to contact us electronically. If a user takes advantage of this possibility, the data entered into our form will be transmitted to us, saved, and otherwise processed. 
 
Depending on the contact form you use, the reason you state for contacting us, and the means of contact you select, we may ask for different data. These data may include the following:
 
(1) Department to be contacted; 
(2) Form of address, first name, surname;
(3) Means of contact: telephone, e-mail, or post;
(4) Company, street, house number, zip code, city;
and/or
(5) Your message.
 
At the time you send us your message, the following additional data will be saved: date and time of your request. 
Moreover, we will send to Google Analytics the following data:
(1) Area of your question
(2) Time your question was submitted.
 
In connection with the message procedure, we will request your consent to the processing of your data and refer to this Data Privacy Policy.
 
In the alternative, it is possible for you to contact us via the e-mail address we provide. In this case, the personal data transmitted with your e-mail message will be saved. 
 
No data are passed on to third parties in this connection. Your data are used exclusively for the purpose of processing our conversation.
 

2. Legal basis for the processing of data

The legal basis for our processing of data is, where the user has consented thereto, Art. 6 Para. 1 lit. a GDPR. When the contact request is intended to initiate a broker’s agreement, Art. 6 Para. 1 lit. b GDPR provides an additional legal basis therefor. 
 
The legal basis for our processing of data which are transmitted in connection with the sending of an e-mail is Art. 6 Para. 1 lit. f GDPR. When the contact request is intended to initiate an agreement, Art. 6 Para. 1 lit. b GDPR provides an additional legal basis therefor.
 

3. Purpose of our processing of data

 
The processing of personal data entered into the contact form serves exclusively to help us process your contact request and your real estate questions (in particular information about particular properties, requests for exposés, and requests for appointments for the purpose of a general consultation or viewing of a particular property). 
 
In the event that you submit a request to be contacted or provided with information about a specific property by e-mail, such request also constitutes our required legitimate interest in processing your data.
 
When the contact request is intended to initiate the signing of an agreement or seek the referral of an agreement through the broker, our processing of your personal data also makes it possible to prove our activity as broker on your behalf.
 
The other personal data collected in connection with the procedure for sending your contact request serve to prevent abuse of the contact form and ensure the security of our information technology systems.
 

4. Term of storage

The data will be erased as soon as they are no longer needed to achieve the purpose for which they were stored. With respect to the personal data collected by means of a user’s entries into the contact form and such as are sent to us by e-mail, this will be the case when the conversation with that user has been concluded. The conversation is concluded when the circumstances indicate that the matter in question has been definitively settled. 
 
Any additional personal data collected during the process of sending the contact form will be erased after a period of no longer than seven days.
 

5. Objection and Erasure

The user can revoke his consent to our processing of his personal data at any time. Where the user has contacted us by e-mail, he can object to our storage of his personal data at any time. In this case, it is not possible to carry on the conversation.
 
The simplest way for you to revoke your consent or submit an objection is to write an e-mail to the following address: info@grossmann-berger.de.
In that case, all personal data which were saved in the course of your contacting us will be erased.
 

VIII. Rights of the Data subject

If personal data pertaining to you as user are processed, you constitute a data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis us as the Controller:
 

1. Right of information

You are entitled to require that we confirm whether any personal data concerning you are being processed by us. 
If that is the case, you are entitled to require that we disclose the following information to you:
 
(1) the purposes for the processing of your personal data;
(2) the categories of personal data being processed;
(3) the recipients or the categories of recipient to whom your personal data have been or will be disclosed;
(4) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(5) the existence of the right to request from the Controller rectification or erasure of your personal data or restriction of processing of your personal data or to object to such processing; 
(6) the existence of the right to lodge a complaint with a supervisory authority;
(7) where the personal data are not collected from you as data subject, any available information as to their source;
(8) the existence of automated decision-making, including profiling, referred to in Article 22 Paras. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you as data subject.
 
You have the right to demand information about whether your personal data have been transmitted to any foreign country or international organization; and in connection herewith, the right to be informed about the appropriate safeguards under Art. 46 GDPR relative to such transmission.
 

2. Right to Rectification 

You have the right to insist on rectification and/or completion from us, to the extent the personal data pertaining to you which we process are false or incomplete. We are obligated to carry out the rectification without undue delay.
 

3. Right to restriction of processing

Under the following conditions, you may require that we restrict the processing of personal data pertaining to you:
 
(1) if you challenge the accuracy of the personal data pertaining to you for a period of time enabling us as Controller to verify the accuracy of such personal data;
(2) the processing of your personal data is unlawful, you oppose the erasure of the personal data, and request the restriction of their use instead;
(3) we as Controller no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; or
(4) if you have objected to the processing of your personal data pursuant to Art. 21 Para. 1 GDPR, and it has not yet been determined whether the Controller’s legitimate interests outweigh your interests.
 
If the processing of your personal data has been restricted, these data may be processed – apart from the process of storing them – only with your consent or for the purpose of establishing, exercising, or defending legal claims or protecting the rights of another natural or legal person, or for reasons constituting a significant public interest of the European Union or a Member State.
 
If the processing of your personal data has been restricted in accordance with the conditions set forth above, we will notify you before the restriction is lifted.
 

4. Right to Erasure

a) Duty to erase

You may require that we erase the personal data pertaining to you without undue delay, and we are obligated to erase such data without undue delay where one of the following grounds applies:
 
(1) The personal data pertaining to you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(2) You revoke the consent upon which our processing of your data was based pursuant to Art. 6 Para. 1 lit. a GDPR, and there is no other basis in law for such processing;
(3) You object to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 2 Para. 2 GDPR; 
(4) Your personal data have been unlawfully processed;
(5) Your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject; or
(6) Your personal data have been collected in relation to the offer of information society services referred to in Art. 8 Para. 1 GDPR.
 

b) Notification of third parties

Where we as Controller have made your personal data public and are obliged pursuant to Art. 17 Para. 1 GDPR to erase the personal data, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers which are processing your personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data. 
 

c) Exceptions

The right to erasure does not apply where processing of your personal data is necessary:
 
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires the processing under Union or Member State law to which the Controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
(3) for reasons of public interest in the area of public health in accordance with Art. 9 Para. 2 lit. h and i as well as Art. 9 Para. 3 GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 Para. 1 GDPR in so far as the right to erasure referred to in Art. 17 Para. 1 GDPR is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise or defense of legal claims.
 

5. Right to notification

If you have exercised your right to rectification, erasure, or restriction of processing with regard to us as Controller, we are obligated to communicate this to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
 
We will inform you about those recipients if you request.
 

6. Right to data portability

You as data subject have the right to receive the personal data concerning you, which you have provided to us as Controller, in a structured, commonly used and machine-readable format. Moreover, you have the right to transmit those data to another controller without hindrance from us, as the Controller to which the personal data have been provided, where:
 
(1) the processing is based on consent pursuant to Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or on a contract pursuant to Art. 6 Para. 1 lit. b GDPR; and
(2) the processing is carried out by automated means.
 
In exercising this right, you moreover have the right to have the personal data transmitted directly from us as Controller to another controller, where technically feasible.
 
The right to data portability shall not adversely affect the rights and freedoms of others; and this right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as Controller.
 

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 Para. 1 lit. e or f GDPR, including profiling based on those provisions.
 
In this case, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms; or such processing serves the establishment, exercise or defense of legal claims.
 
Where your personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
 
Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.
 
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to revoke your consent under data privacy law

You have the right to revoke, at any time, your consent under data privacy law. Such revocation of consent shall have no impact on the lawfulness of processing conducted on the basis of such consent prior to its revocation.
 

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or with similar significance affects you.
 
The foregoing shall not apply if the decision 
 
(1) is necessary for entering into, or performance of, a contract between you and us as data Controller; 
(2) is authorized by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests as data subject; or 
(3) is based on your explicit consent.
 
Such decisions, however, may not be based on special categories of personal data referred to in Article 9 Para. 1 GDPR, unless Art. 9 Para. 2 lit. a or g applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
 
In the cases referred to in points (1) and (3) above, we as data Controller will implement suitable measures to safeguard your rights and freedoms and legitimate interests, including at least your right to obtain the intervention of a natural person on our part, the right to express your point of view, and the right to contest the decision.
 

10.  Right to lodge a complaint with a supervisory authority 

Without prejudice to any other administrative or judicial remedy, you as data subject have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
 
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.
 
facebook google plus youtube xing