With this data protection information, we inform you about our handling of your personal data and about your rights according to the European Data Protection Basic Regulation (DSGVO) and the Federal Data Protection Act (BDSG). OWNR Deutschland GmbH (hereinafter referred to as "we" or "us") is responsible for data processing.
If you have any questions or suggestions regarding this information or if you would like to contact us regarding the assertion of your rights, please send your request to
OWNR Germany GmbH
Phone: +49 40 69 63 2520
2. Legal Bases
The data protection term "personal data" refers to all information that relates to a specific or identifiable person. We process personal data in compliance with the relevant data protection regulations, in particular the DSGVO and the BDSG. Data processing by us is only carried out on the basis of a legal permission. We process personal data only with your consent (Section 15 (3) TMG or Art. 6 (1) (a) DSGVO), for the performance of a contract to which you are a party or at your request for the implementation of pre-contractual measures (Art. 6 (1) (b) DSGVO), for the fulfilment of a legal obligation (Art. 6 para. 1 letter c DSGVO) or if the processing is necessary to protect our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms that require the protection of personal data outweigh these (Art. 6 para. 1 letter f DSGVO).
If you apply for an open position in our company, we will also process your personal data to decide on the establishment of an employment relationship (Art. 26 para. 1 p. 1 BDSG).
3. Duration of Storage
Unless otherwise stated in the following information, we only store the data for as long as is necessary to achieve the purpose of processing or to fulfil our contractual or legal obligations. Such legal storage obligations may result in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will retain such personal data contained in our accounting data for ten years and retain personal data contained in commercial letters and contracts for six years. In addition, we will retain data relating to consents subject to proof and to claims for complaints and demands for the duration of the statutory limitation periods.
4. Categories of Recipients of the Data
We use contract processors to process your data. The processing operations carried out by such processors include, for example, hosting, maintenance and support of IT systems, customer and order management, order processing, accounting and billing, marketing activities or the destruction of files and data carriers. A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller. Commissioned processors do not use the data for their own purposes but carry out the data processing exclusively for the data controller and are contractually obliged to ensure appropriate technical and organizational measures for data protection. In addition, we may transfer your personal data to entities such as postal and delivery services, house bank, tax advisor/auditor or the tax authorities. Further recipients may result from the following information.
5. Data Transfer to Third Countries
Visiting our website may involve the transfer of certain personal data to third countries i.e., countries in which the DSGVO is not applicable law. Such a transfer is permissible if the European Commission has established that an adequate level of data protection is offered in such a third country. In the absence of such an adequacy finding by the European Commission, personal data will only be transferred to a third country if appropriate guarantees in accordance with Art. 46 DSGVO or if one of the conditions of Art. 49 DSGVO is met.
Unless otherwise stated below, we use as appropriate guarantees the EU standard contractual clauses for the transfer of personal data to processors in third countries: eur-lex.europa.eu/legal-content/DE/TXT/.
6. Processing in the Exercise of your Rights under Articles 15 to 22 DSGVO
If you exercise your rights under Articles 15 to 22 of the DPA, we process the personal data provided for the purpose of implementing these rights by us and to provide proof of this. We will process data stored for the purpose of providing information and preparing it only for this purpose as well as for the purposes of data protection control and otherwise restrict processing in accordance with Art. 18 DSGVO.
These processing operations are based on the legal basis of Art. 6 para. 1 letter. c DSGVO in conjunction with Art. 15 to 22 DSGVO and Art. 34 para. 2 BDSG.
7. Your Rights
As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:
- In accordance with Art. 15 DSGVO and § 34 BDSG, you have the right to demand information as to whether and, if so, to what extent we process personal data relating to your person or not.
- In accordance with Art. 16 DSGVO, you have the right to demand that we correct your data.
- You have the right to demand that we delete your personal data in accordance with Art. 17 DSGVO and § 35 BDSG.
- You have the right to have the processing of your personal data restricted in accordance with Art. 18 DSGVO.
- In accordance with Art. 20 DSGVO, you have the right to receive the personal data relating to you that you have provided us with in a structured, common and machine-readable format and to transfer this data to another person responsible.
- If you have given us separate consent for data processing, you may revoke this consent at any time in accordance with Art. 7 para. 3 DSGVO. Such revocation does not affect the lawfulness of the processing, which has been carried out until revocation based on the consent.
- If you are of the opinion that the processing of your personal data is in breach of the provisions of the DSGVO, you have the right to appeal to a supervisory authority in accordance with Art. 77 DSGVO.
8. Right of Objection
You have the right to object to processing operations based on the legal basis of Article 6(1)(e) or (f) of the DPA on grounds relating to your particular situation, in accordance with Article 21(1) of the DPA. If personal data relating to you is processed by us for the purpose of direct marketing, you may object to this processing in accordance with Art. 21 para. 2 and para. 3 DSGVO.
9. Data Protection Officer
You can reach our data protection officer at the following contact details:
Herting Oberbeck Data Protection GmbH
Hallerstr. 76, 20146 Hamburg
When using the website, we collect information that you provide yourself. In addition, certain information about your use of the Site is automatically collected during your visit to the Site. In data protection law, the IP address is also generally regarded as a personal date. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.
1. Processing of Server Log Files
In the case of purely informative use of our website, general information is initially stored automatically (i.e., not via registration), which your browser sends to our server. This includes by default: browser type/version, operating system used, page accessed, the page previously visited (referrer URL), IP address, date and time of the server request and HTTP status code. The processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6 para. 1 letter f DSGVO. This processing serves the technical administration of the website. The stored data will not be permanently stored by us. We are therefore not in a position to identify you as a person concerned on the basis of the stored information.
For the hosting of our website, the storage services of Amazon Web Services (AWS) of Amazon Web Services, Inc. Box 81226, Seattle, WA 98108-1226, USA. The data is stored exclusively in a German data centre (Frankfurt/Main), which is certified according to ISO 27001, 27017 and 2018 as well as PCI DSS Level 1. At Amazon, a transfer of data to Amazon Web Services, Inc. in the USA cannot be excluded. Please refer to the notes in the section "Data transfer to third countries". Further information on data protection at Amazon can be found here: aws.amazon.com/de/compliance/data-privacy/
3. Consent Management Tool
This website uses a consensus management banner to control cookies. The content banner enables users of our website to give their consent to certain data processing procedures or to revoke any consent given. By confirming the "OK" button or by saving individual cookie settings, you agree to the use of the associated cookies. The legal basis under data protection law is your consent within the meaning of Art. 6 para. 1 letter a) DSGVO.
The banner also helps us to provide proof of your consent. For this purpose, we process information on the declaration of consent and further protocol data on this declaration. Cookies are also used to collect this data.
The processing of this data is necessary to be able to prove a given consent. The legal basis results from our legal obligation to document your consent (Art. 6 Par. 1 Letter c) in connection with Art. 7 para. 1 DSGVO).
Here you can withdraw your consent for cookies:
4. Contact Possibilities and Inquiries
Our website contains a contact form where you can send us messages. The transfer of your data is encrypted. All data fields marked as mandatory fields are required to process your request. Failure to provide this information means that we will not be able to process your request. The provision of further data is voluntary. Alternatively, you can also send us a message via the contact e-mail. We process the data for the purpose of answering your request. If your inquiry is directed at the conclusion or implementation of a contract with us, Art. 6 para. 1 letter b DSGVO is the legal basis for data processing. Otherwise, we process the data on the basis of our legitimate interest in getting in contact with inquiring persons. The legal basis for data processing is then Art. 6 para. 1 letter f DSGVO.
In order to use certain functions of the website (especially the management of your property requests), registration via the website is required. The required information can be found in the registration form. The provision of information marked as mandatory is mandatory in order to complete the registration. The data provided will be processed for the purpose of providing the service. The processing is based on the legal basis of article 6 paragraph 1 letter b) DSGVO.
If you register via our website, we use the service provider Salesforce to log in and display your user data in the personal area. With Salesforce, a transfer of data to Salesforce Inc. in the USA cannot be excluded. Please refer to the notes in the section "Data transfer to third countries". Salesforce uses Binding Corporate Rules for international data transfer and has also agreed standard EU contract clauses with customers. For more information, please visit https://www.salesforce.com/de/company/privacy/.
a. Logging in and out
On our website we offer the possibility to subscribe to various newsletters from us. After the registration we will inform you regularly about the latest news about our offers. A valid e-mail address is required to register for the newsletter. To verify the e-mail address, you will first receive a registration e-mail, which you must confirm via a link (double opt-in). If you subscribe to the newsletter on our website, we process personal data such as your e-mail address and your name on the basis of the consent you have given. The processing is based on the legal basis of article 6 paragraph 1 letter a DSGVO. You can revoke the consent you have given at any time with effect for the future, for example by clicking on the "unsubscribe" link in the newsletter or by contacting us via the above-mentioned channels. The legality of the data processing operations already performed remains unaffected by the revocation. When you register for the newsletter, we also store the IP address and the date and time of registration. The processing of this data is necessary to prove that you have given your consent. The legal basis results from our legal obligation to document your consent (Art. 6 para. 1 letter c in conjunction with Art. 7 para. 1 DSGVO).
We also analyse the reading behaviour and opening rates of our newsletter. For this purpose, we collect and process pseudonymized usage data which we do not merge with your e-mail address or IP address. The legal basis for the analysis of our newsletter is your consent in accordance with Art. 6 para. 1 letter a DSGVO, which you give us when you register for ours. You can revoke this consent at any time by unsubscribing from our newsletter.
c. Service provider
We use the Salesforce Marketing Cloud of the provider Salesforce Inc. to manage the subscribers and to send the newsletter, so your email address will be transmitted to Salesforce by us. The processing is carried out on our behalf and is based on the legal basis of Art. 6 letter f DSGVO and serves our legitimate interest in the optimization and economic dispatch of our newsletter. If you do not want your data to be processed by Salesforce, you should not subscribe to the newsletter or unsubscribe from it. Salesforce uses Binding Corporate Rules for international data transfer and has agreed with customers on additional EU standard contract clauses. For more information, please visit www.salesforce.com/de/company/privacy/.
7. Object Inquiry and Credit Assessment
Using the function "Send request" you can directly send requests for the objects you have selected. For this purpose, the personal data provided by you during registration will be processed by us. Legal basis for the data processing: Art. 6 para. 1 b) DSGVO. All data fields marked as mandatory fields are required for the execution of the contract. Failure to provide the data will result in the contractual service not being able to be performed. The provision of further data is voluntary.
Our company regularly checks your creditworthiness before concluding a contract, especially in case of an inquiry for a leasing object. For this purpose, we work together with Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss, from which we receive the necessary data. For this purpose, we transmit your name and contact details to Creditreform Boniversum GmbH. You can find a detailed description of the data processing at Creditreform Boniversum GmbH here: www.boniversum.de/eu-dsgvo/
8. Google Analytics
Further information about this processing activity, the technologies used, stored data and storage duration can be found in the settings of our Consent Management Tool. The use of Google Marketing Services only takes place with your consent in accordance with § 15 paragraph 3 TMG or Art. 6 paragraph 1 letter a DSGVO. You can revoke your consent at any time via the settings of our Consent Management.
We use the Google Tag Manager of Google Ireland Limited (Ireland/EU). The Google Tag Manager is used to manage our website tags via an interface. The Google Tag Manager is a "cookie-free" domain that does not collect or store any personal data. The Google Tag Manager only triggers other tags that may collect data without accessing the data itself. If deactivation is made at the domain or cookie level, it will remain in effect for all tracking tags implemented with Google Tag Manager.
Our website uses a plugin from the provider Hotjar Ltd. (Malta/EU), through which we perform an analysis of movements on our website using so-called "heat maps". For example, we can see how far users scroll and which buttons users click on how often. The tool also allows us to obtain feedback directly from users of the website. In this way, we obtain valuable information to make our website even faster and more customer friendly.
With Hotjar, we can only track which buttons are clicked, the course of the mouse, how far it scrolls, the screen size of the device, device type and browser information. We also receive information about your geographic location (country) and the preferred language for displaying our website. Areas of the websites where personal data of you or third parties are displayed are automatically hidden by Hotjar and therefore cannot be traced by the tool at any time. You can find further information on Hotjar's data protection on the following website: www.hotjar.com/legal/policies/privacy
Hotjar is only used with your consent in accordance with § 15 paragraph 3 TMG or Art. 6 paragraph 1 letter a DSGVO. You can revoke your consent at any time via the settings of our Consent Management.
10. Google Fonts and reCAPTCHA
We use on our website the services Google Fonts and reCAPTCHA of Google Ireland Limited (Ireland/EU). For such integration, it is technically necessary to process your IP address so that the content can be sent to your browser. Your IP address is therefore transmitted to Google.
The integration of Google Fonts serves to display fonts and is done to protect our legitimate interests in the optimization and economic operation of our website. The legal basis is article 6 paragraph 1 letter f DSGVO.
The activation of reCAPTCHA is also only carried out with your consent in accordance with § 15 paragraph 3 TMG or Art. 6 paragraph 1 letter a DSGVO. You can revoke your consent at any time via the settings of our Consent Management.
In the case of Google services, a transfer of data to Google Inc. in the USA cannot be excluded. Please note the information in the section "Data transfer to third countries". Users can find further information on data protection at Google in the Google data protection notices: https://www.google.com/policies/privacy
We are represented on several social media platforms with a corporate website. Through this we would like to offer further possibilities for information about our company and for exchange. Our company has company pages on the following social media platforms:
When you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile used also regularly constitutes personal data. This also includes messages and statements made using the profile. In addition, during your visit to a social media profile, certain information about it is often automatically collected, which may also represent personal data.
1. Visit of a Social Media Page
a. Facebook and Instagram Page
When you visit our Facebook or Instagram page, through which we present our company or individual products from our range, certain information about you is processed. The sole responsible party for this processing of personal data is Facebook Ireland Ltd (Ireland/EU - "Facebook"). Further information about the processing of personal data by Facebook can be found at www.facebook.com/privacy/explanation. Facebook offers the opportunity to object to certain data processing; for information on this and opt-out options, please visit www.facebook.com/settings.
Please note that according to the Facebook data protection regulations, user data is also processed in the USA or other third countries. Facebook only transfers user data to countries for which an adequacy decision of the European Commission has been made in accordance with Art. 45 DSGVO or on the basis of appropriate guarantees in accordance with Art. 46 DSGVO.
b. LinkedIn Corporate Site
In principle, LinkedIn Ireland Unlimited Company (Ireland/EU - "LinkedIn") is solely responsible for the processing of personal data when visiting our LinkedIn site. For more information about LinkedIn's processing of personal data, please visit www.linkedin.com/legal/privacy-policy.
When you visit, follow or interact with our LinkedIn company site, LinkedIn processes personal information to provide us with statistics and insights in an anonymous form. This provides us with information about the types of actions that people take on our site (known as site insights). For this purpose, LinkedIn processes in particular such data that you have already provided to LinkedIn through the information in your profile, such as information on function, country, industry, seniority, company size and employment status. In addition, LinkedIn will process information about how you interact with our LinkedIn business site, such as whether you are a follower of our LinkedIn business site. LinkedIn does not provide us with any personal information about you through the Site Insights. We only have access to the summarized Page-Insights. It is also not possible for us to draw conclusions about individual members from the information contained in Page-Insights. This processing of personal data within the scope of the Seiten-Insights is carried out by LinkedIn and us as jointly responsible parties. The processing serves our legitimate interest in evaluating the types of actions performed on our LinkedIn corporate site and improving our corporate site based on these insights. The legal basis for this processing is article 6 paragraph 1 letter f DSGVO. We have entered into an agreement with LinkedIn on processing as jointly responsible party, in which the distribution of data protection obligations between us and LinkedIn is laid down. The agreement is available at: legal.linkedin.com/pages-joint-controller-addendum. Afterwards the following applies:
- LinkedIn and we have agreed that the Irish Data Protection Commission will be the lead regulatory authority overseeing the processing for Seiten-Insights. You always have the right to file a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other regulatory body.
In principle, New Work SE (Germany/EU) is solely responsible for processing personal data when visiting our Xing profile. Further information on the processing of personal data by New Work SE can be found at https://privacy.xing.com/de/datenschutzerklaerung.
2. Comments and Direct Messages
We also process information that you have made available to us via our company site on the respective social media platform. Such information may be the username used, contact information or a message to us. We process this information as the sole responsible party. We process this data because of our legitimate interest in getting in contact with requesting persons. The legal basis for data processing is Art. 6 Par. 1 letter f DSGVO. Further data processing may be carried out if you have given your consent (Art. 6 para. 1 letter a DSGVO) or if this is necessary to fulfil a legal obligation (Art. 6 para. 1 letter c DSGVO)
1. Contact by E-mail
If you send us a message via the specified contact e-mail, we will process the data transmitted for the purpose of answering your inquiry. We process this data because of our legitimate interest in getting in contact with inquiring persons. The legal basis for data processing is Art. 6 Par. 1 letter f DSGVO.
2. Use of the E-mail Address for Marketing Purposes
We may use the e-mail address you provide during registration or ordering to inform you about similar products and services offered by us. The legal basis is article 6 paragraph 1 letter f DSGVO in conjunction with § 7 paragraph 3 UWG. You may object to this at any time without incurring any costs other than the transmission costs according to the basic rates. To do so, you can unsubscribe by clicking on the unsubscribe link included in each mailing or by sending an e-mail to email@example.com.
If you apply to our company, we process your application data exclusively for purposes related to your interest in a current or future employment with us and the processing of your application. Your application will only be processed and acknowledged by the relevant contact persons at our company. All employees entrusted with data processing are obliged to maintain the confidentiality of your data. If we are unable to offer you employment, we will retain the data you provide for up to six months after any rejection for the purpose of answering questions in connection with your application and rejection. This does not apply if legal provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage. The legal basis for data processing is § 26 para. 1 p. 1 BDSG. Should we store your applicant data beyond a period of six months, and you have expressly consented to this, we point out that this consent can be freely revoked at any time in accordance with Art. 7 Para. 3 DSGVO. Such a revocation will ensure the lawfulness of the processing, which is subject to the consent given until revocation.