1. name and contact details of the controller

GWH Wohnungsgesellschaft mbH Hessen
Westerbachstraße 33
60489 Frankfurt am Main

Tel.: 069 97551-0
E-mail: info@gwh.de
Website: www.gwh.de

 

2. contact details of the data protection officer

GWH Wohnungsgesellschaft mbH Hessen
Data Protection Officer
Westerbachstraße 33
60489 Frankfurt am Main

E-mail: datenschutz@gwh.de

 

3. purpose and legal basis of the data processing

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Your personal data will only be collected, processed and stored for the purposes expressly stated here.

We process your personal data as part of the tenancy agreement

- on the basis of your consent in accordance with Art. 6 para. 1 a) GDPR:

If we have been given consent to process personal data for specific, aforementioned purposes, the lawfulness of this processing is based on consent. Consent that has been given can be withdrawn at any time. The withdrawal of consent does not affect the lawfulness of the data processed until the withdrawal.

- to fulfill a contract that we have concluded with you or to carry out pre-contractual measures that take place at your request, in accordance with Art. 6 Para. 1 b) GDPR:

The processing of personal data takes place for the execution and handling of your tenancy.

- To fulfill legal obligations to which we are subject, in accordance with Art. 6 para. 1 c) GDPR.

- To protect our legitimate interests or the legitimate interests of a third party in accordance with Art. 6 para. 1 f) GDPR:

Where necessary, we process your personal data to protect our legitimate interests or those of third parties, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail.

Our legitimate interests include, among other things

- Assertion of legal claims and defense in legal disputes
- Ensuring IT security and IT operations
- Protecting our property (especially when operating video surveillance systems)
- Measures for building and system security

In accordance with Art. 21 (4) in conjunction with (1) and (2) GDPR, you can object at any time to the processing of personal data concerning you that we process on the basis of a legitimate interest.

 

4. recipient of the data

The following recipients may receive personal data from us:

Property owners - to fulfill our contractual obligations as managers of properties owned by third parties, e.g. capital management companies

Building managers - to fulfill building management contracts that we conclude with managers as owners or service providers of property owners

Handyman companies - for carrying out repairs and maintenance work on rental properties

Metering service provider - for billing operating and heating costs

Credit institutions - for the processing of payment transactions

Service provider for file and data carrier destruction - for the proper destruction of business documents

Service provider for file digitization and archiving - for archiving business documents, tenant files

IT service provider - in the context of IT operations
In particular: Aareon Deutschland GmbH as processor for the operation of our central data processing system

Security services - in the context of video surveillance

Lawyers and courts - in the context of enforcing legal claims

Authorities and offices - in the course of fulfilling legal obligations to provide information and for law enforcement purposes

Auditors - within the scope of statutory audit assignments

Insurance - for the settlement of claims

 

5 Existing rights of the data subject

As a data subject, you have the following data protection rights under the GDPR and the BDSG:

a) Right of access pursuant to Art. 15 GDPR
b) Right to rectification of inaccurate data pursuant to Art. 16 GDPR
c) Right to erasure pursuant to Art. 17 GDPR ("right to be forgotten")
d) Right to restriction of processing pursuant to Art. 18 GDPR
e) Right to data portability pursuant to Art. 20 GDPR
f) Right to object pursuant to Art. 21 GDPR
g) Right not to be subject to a decision based solely on automated processing - including profiling - pursuant to Art. 22 GDPR
h) Right to withdraw consent under data protection law
i) Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR/§ 19 BDSG

 

6. duration of data storage

We store your personal data for as long as is necessary to fulfill our legal and contractual obligations. As soon as you become a tenant, your existing personal data will be transferred to our SAP IT system.
After the respective purpose of processing and use no longer applies, the relevant retention periods under commercial and tax law, for example in accordance with Section 257 of the German Commercial Code (HGB), apply in individual cases. In the case of terminated tenancies, longer data storage may also be necessary due to unsettled rental accounts or legal disputes.

If it is necessary to preserve evidence, for example in the context of legal proceedings, please note that the limitation periods of the German Civil Code (BGB) can be up to 30 years if a court title exists (Sections 195 et seq. BGB). If no court title has been obtained against the person concerned, the regular limitation period of three years applies.

 

7. data transfer to third countries

Data is not currently transferred to third countries or to an international organization, nor is this planned.

 

8. legal or contractual regulations for the provision of personal data

As part of our business relationship, the personal data that is required for the establishment and execution of a business relationship and the fulfillment of the associated contractual obligations or that we are legally obliged to collect must be provided.
Without this data, we will not be able to conclude or execute a contract. If information can be provided voluntarily, we have marked this information in the respective data collection form.

 

9. automated decision-making, profiling

In principle, we do not use exclusively automated decision-making or profiling within the meaning of Art. 22 GDPR to establish and conduct the business relationship.