1. name and contact details of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is the:

GWH Wohnungsgesellschaft mbH Hessen
Westerbachstraße 33
60489 Frankfurt am Main

Phone: 069 97551 0

E-mail: info@gwh.de

Website: www.gwh.de

 

2. contact details of the data protection officer

You can reach our data protection officer using the following contact details:

GWH Wohnungsgesellschaft mbH Hessen
Data Protection Officer
Westerbachstraße 33
60489 Frankfurt am Main

E-mail: datenschutz@gwh.de

 

3. purpose and legal basis of the data processing

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Your personal data will only be collected, processed and stored for the purposes expressly stated here.

We process your personal data for the preparation and execution of the real estate purchase contract

• on the basis of your consent pursuant to Art. 6 (1) a) GDPR:
  If you have given us your consent to process personal data for specific, aforementioned purposes, this processing is lawful on the basis of consent. Consent that has been granted can be withdrawn at any time. The withdrawal of consent does not affect the lawfulness of the data processed until the withdrawal. In such cases, we will inform you again separately about the intended data processing.
• to carry out contractual measures and/or to fulfill contractual obligations in accordance with Art. 6 para. 1 b) GDPR:
  The processing of personal data is carried out for the execution and processing of the real estate purchase contract with GWH Wohnungsgesellschaft mbH Hessen.
• to fulfill legal obligations pursuant to Art. 6 para. 1 c) GDPR:
  As a company, we are subject to various legal obligations. The processing of personal data may be necessary to fulfill these obligations.
• Control and reporting obligations
• as part of the balancing of interests in accordance with Art. 6 para. 1 f) GDPR:
  If necessary, we process personal data beyond the actual fulfillment of the contract or pre-contractual measures to protect our legitimate interests or those of third parties.

 

This includes:

• Assertion of legal claims and defense in legal disputes
• Ensuring IT security and IT operations
• Prevention and investigation of criminal offenses (especially when operating video reconnaissance devices)
• Measures for building and plant safety

 

In accordance with Art. 21 (4) in conjunction with (1) and (2) GDPR, you can object at any time to the processing of personal data concerning you that we process on the basis of a legitimate interest.

 

4. categories of personal data

Name and address data, telephone number, e-mail address, date of birth, bank details, tax ID

 

5. recipient of the data

The following recipients may receive data from us for the following purposes:

• Tradesmen: to carry out repairs and maintenance work on purchased properties
• Metering service provider: for the provision of metering services
• WEG management: for the management of the property
• Credit institutions: for the processing of payment transactions
• Processor for file and data carrier destruction: for the proper destruction of business documents
• Processor for file digitization and archiving: for archiving business documents
• IT service provider: as part of IT operations
• In particular: Aareon Deutschland GmbH as processor for the operation of our central data processing system
• Lawyers and courts: in the context of enforcing legal claims
• Authorities and offices: in the course of fulfilling legal obligations to provide information
• Auditor: within the scope of statutory audit assignments
• Insurance: to take over existing insurance relationships
• Notaries: for the preparation and execution of contracts

 

6 Existing rights of the data subject

As a data subject, you have the following data protection rights under the GDPR and the BDSG:

a) Right of access pursuant to Art. 15 GDPR
b) Right to rectification of inaccurate data pursuant to Art. 16 GDPR
c) Right to erasure pursuant to Art. 17 GDPR ("right to be forgotten")
d) Right to restriction of processing pursuant to Art. 18 GDPR
e) Right to data portability pursuant to Art. 20 GDPR
f) Right to object pursuant to Art. 21 GDPR
g) Right not to be subject to a decision based solely on automated processing - including profiling - pursuant to Art. 22 GDPR
h) Right to withdraw consent under data protection law
i) Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR/§ 19 BDSG

 

7. source of the personal data

The personal data originates from our sales partners who are commissioned to sell the properties.

 

8. duration of data storage

We store your personal data for as long as is necessary to fulfill our legal and contractual obligations. As soon as you become a buyer, your existing personal data will be transferred to our SAP IT system. After the respective purpose of processing and use no longer applies, the relevant retention periods under commercial and tax law, for example in accordance with Section 257 of the German Commercial Code (HGB), apply in individual cases.

If it is necessary to preserve evidence, for example in the context of legal proceedings, please note that the limitation periods of the German Civil Code (BGB) can be up to 30 years if a court title exists (Sections 195 et seq. BGB). If no court title has been obtained against the person concerned, the regular limitation period of three years applies.

 

9. data transfer to third countries

Data is not currently transferred to third countries or to an international organization, nor is this planned.

 

10. legal or contractual regulations for the provision of personal data

As part of our business relationship, the personal data that is required for the establishment and execution of a business relationship and the fulfillment of the associated contractual obligations or that we are legally obliged to collect must be provided. Without this data, we will not be able to conclude or execute a contract. If information can be provided voluntarily, we have marked this information in the respective data collection form.

 

11. automated decision-making, profiling

In principle, we do not use exclusively automated decision-making or profiling within the meaning of Art. 22 GDPR to establish and conduct the business relationship.