TAG Wohnen & Service GmbH data protection information for tenants and prospective tenants

With this information in accordance with Articles 13, 14 and 21 of the General Data Protection Regulation (hereinafter “GDPR”), we provide you with an overview of the processing of your personal data by TAG Wohnen & Service GmbH (hereinafter “TAG Wohnen”) and your rights under the European General Data Protection Regulation, which came into force on May 25, 2018. Which data is processed in detail and how it is used depends largely on the business relationship and the agreements made with us. Therefore, not all parts of this data protection information may apply to you.


Who is responsible for data processing and who can I contact?

The entity responsible for data processing is
TAG Wohnen & Service GmbH
Steckelhörn 5, 20457 Hamburg, Germany.

Please address your questions about data protection to
TAG Immobilien AG
Data Protection Management
Kreuzstraße 7 c, 04103 Leipzig
E-mail: datenschutz@tag-ag.com

TAG Immobilien AG has appointed as external data protection officer
DOMUS Consult Wirtschaftsberatungsgesellschaft mbH
Schornsteinfegergasse 13, 14482 Potsdam-Babelsberg
Telephone: 0331 743 30-0
E-mail: datenschutz@tag-ag.com

These contact details of the data protection officer for TAG Wohnen also apply to all companies affiliated with TAG Immobilien AG (hereinafter “TAG”) under company law, i.e. all companies belonging to the TAG Group.

When does data protection apply to me and when am I a data subject?

This data protection notice is aimed at prospective tenants, visitors to the TAG Wohnen website, tenants and users and other customers whose personal data is collected by TAG Wohnen in its own name or on behalf of other companies in the TAG Group. The TAG Group includes all companies affiliated with TAG Immobilien AG (hereinafter: “TAG”). As a rule, TAG Wohnen acts as the representative and authorized agent of the TAG companies that own the properties and apartments (hereinafter also referred to as the “portfolio company”) and which do not have their own operations. Within the TAG Group, TAG Wohnen is responsible in particular for the operational rental business and handles this centrally. It establishes contact with you as a prospective tenant or tenant and collects and processes your personal data.

In accordance with the terminology used in the GDPR, tenants, prospective tenants and persons whose personal data is collected are also referred to as “data subjects”. In particular, data subjects also include authorized representatives, caregivers or third-party guarantors such as sureties and guarantors.

For reasons of better readability, the masculine and feminine forms of language are not used simultaneously. All personal designations nevertheless apply to both genders.

What sources and data do we use?

We process personal data that we receive from our customers or other data subjects as part of our business relationship. In addition, we process - to the extent necessary for the provision of our services and business activities - personal data that is legitimately obtained from publicly accessible sources (e.g. land registers, debtor directories, commercial registers) or that is legitimately transmitted to us by other companies in the TAG Group or by other third parties (e.g. credit agencies).

Relevant personal data are personal details (name, address and other contact data, date and place of birth and nationality), identification data (e.g. ID card data) and authentication data (e.g. specimen signature). In addition, this may also include order data (e.g. payment orders), data from the fulfillment of our contractual obligations, information about your financial situation (e.g. creditworthiness data), advertising and sales data including advertising scores, documentation data, data about your use of the telemedia we offer (e.g. access to our website at tag-wohnen.de, apps and/or newsletters, pages or entries clicked on and other data comparable to the categories mentioned).

What do we process your data for (purpose of processing) and on what legal basis?

a. for the fulfillment of contractual obligations (Art. 6 para. 1 b) GDPR)
Data is processed as part of the initiation and conclusion of rental and usage contracts and for the execution of these contracts and all other contracts associated with the administration and management of the properties and apartments owned by the TAG Group's portfolio companies. The purposes of data processing are primarily based on the specific agreement and the specific product, but may also include needs analyses, advice in the context of contract initiation and the execution of purchases and sales. Further details on the data processing purposes can be found in the relevant contract documents and terms and conditions.

b. as part of the balancing of interests (Art. 6 para. 1 f) GDPR)
If necessary, we process your data beyond the actual fulfillment of the contract to protect our legitimate interests or those of third parties, in particular
Consultations of and data exchange with credit agencies (e.g. SCHUFA), to determine creditworthiness and default risks in the rental business,
Examination and optimization of procedures for needs analysis for the purpose of direct customer and, in particular, tenant contact,
Assertion of legal claims and defense in legal disputes,
Ensuring the IT security and IT operations of TAG Wohnen,
Measures for building and facility security (e.g. access controls),
Measures to ensure compliance with building law and
measures for business management and further development of the services and products offered by TAG Wohnen and the other companies in the TAG Group.

c. on the basis of your consent (Art. 6 para. 1 a) GDPR)
If you have given us your consent to process personal data for specific purposes (e.g. disclosure to third parties, evaluation of data for marketing purposes, sending of offers, etc.), the lawfulness of this processing is based on your consent. Any consent given can be revoked at any time. This also applies to the revocation of declarations of consent that were given to us before the GDPR came into force, i.e. before May 25, 2018. The withdrawal of consent is only effective for the future and does not affect the legality of the data processed until the withdrawal.

d. due to legal requirements (Art. 6 para. 1 c) GDPR) or in the public interest (Art. 6 para. 1 e) GDPR)
In addition, TAG and thus also TAG Wohnen and the other companies belonging to the TAG Group are subject to various legal obligations. TAG Immobilien AG is a listed company and must therefore comply with the requirements of the German Securities Trading Act and other capital market regulations, in particular instructions from the German Federal Financial Supervisory Authority (BaFin). The purposes of processing include, among other things, the verification of identities and the fulfillment of tax control and reporting obligations as well as the assessment and management of risks of TAG Wohnen within the TAG Group.

Who receives my data?

Within TAG Wohnen and the TAG Group, those departments that need your data to fulfill our contractual and legal obligations will have access to it. Service providers and vicarious agents employed by us may also receive data for these purposes, for example tradesmen in the context of carrying out repair orders, external brokers for carrying out viewings and preparing the conclusion of contracts (rental and purchase contracts) as well as metering service providers, billing and utility companies, cable companies and banks as well as administrators of condominium owners' associations, insofar as this is necessary. If such third parties receive and process personal data, this is done - where prescribed - within the framework of so-called order processing, which is expressly provided for by law. In these cases, TAG Wohnen remains responsible for the protection of your data. Processors used by us within the meaning of Art. 28 GDPR are, for example, companies in the categories of IT services, printing services, telecommunications, debt collection, sales, marketing and address research.

With regard to the transfer of data to recipients outside the TAG Group, please note that we are obliged to maintain confidentiality about all customer-related facts and evaluations of which we become aware (confidentiality). We may only pass on information about you if this is permitted or required by law, if you have given your consent or if we are authorized to provide information. Under these conditions, recipients of personal data may include in particular
public bodies and institutions (e.g. Federal Financial Supervisory Authority, tax authorities) in the event of a legal or official obligation,
other institutes or comparable institutions to which we transfer personal data (e.g. credit agencies), if this is necessary to carry out the business relationship with you.

Other data recipients may be those bodies for which you have given us your consent to transfer data or which you have named to us as recipients of your data.
In accordance with Art. 6 (1) (f) GDPR, the landlord checks information on the tenant's address data (first name, surname, address, email address, telephone number, if applicable) and creditworthiness in order to safeguard legitimate interests. For this purpose, the landlord works together with Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss and Regis24 GmbH, Wallstr. 58, 10179 Berlin, among others. For this purpose, the landlord transmits the name of the tenant and the contact details to Creditreform Bo-niversum GmbH and Regis24 GmbH, from which it obtains data for these purposes or transmits it to them. The information pursuant to Art. 14 GDPR on the data processing taking place at Creditreform Boniversum GmbH or Regis24 GmbH can be viewed at www.boniversum.de/EU-DSGVO or www.regis24.de/informationen.

Is data transferred to a third country or to an international organization?

Your personal data will not be transferred to third parties, with the exception of the anonymized IP address and the use of website service providers, as described here, it will not be transferred outside the EU.

How long will my data be stored?

We process and store your personal data for as long as this is necessary for the fulfillment of our contractual and legal obligations. It should be noted that our business relationships within the scope of the rental agreements concluded represent continuing obligations and are intended to be permanent.

If the data is no longer required for the fulfillment of contractual and legal obligations, it is regularly deleted, unless its - temporary - further processing is necessary for the following purposes:

Fulfillment of retention obligations under commercial and tax law, which may arise, for example, from the German Commercial Code (HGB), the German Fiscal Code (AO), the German Securities Trading Act (WpHG). The specified periods for storage and documentation are generally two to 10 years.
Preservation of evidence within the framework of the statutory statute of limitations. According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years.

What data protection rights do I have?

Every data subject has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. The restrictions of Sections 34 and 35 BDSG apply to the right to information and the right to erasure. This means that the right to erasure is aimed at restricting the processing of personal data, as TAG is obliged to secure its automated data processing systems (backups) and erasure of personal data in these systems would involve unreasonable and disproportionate effort. Finally, there is a right of appeal to a competent data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG).

You can withdraw your consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent that were given to us before the GDPR came into force, i.e. before May 25, 2018. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected.

The assertion of these data protection rights and in particular the assertion of the revocation are to be sent by e-mail to: datenschutz@tag-ag.com or in writing by post to Data Protection Management
TAG Immobilien AG
Data protection management
Kreuzstraße 7 c, 04103 Leipzig

to be addressed. The assertion of rights is free of charge.

Do I have an obligation to provide data?

As part of our business relationship, you must provide the personal data that is required for the establishment, execution and termination of a business relationship and for the fulfillment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we will generally not be able to conclude, execute and terminate a contract with you.

To what extent does automated decision-making and profiling take place?

In principle, we do not use fully automated decision-making in accordance with Article 22 GDPR to establish and conduct business relationships.

In exceptional cases, we sometimes process your data automatically with the aim of evaluating certain personal aspects (profiling). However, this profiling is only used to inform and advise you about products in a targeted manner. We use evaluation tools for this purpose. These enable needs-based communication and advertising, including market and opinion research.

What data protection measures are observed at TAG Wohnen and the TAG Group?

TAG Wohnen and TAG Immobilien AG have designed the internal organization within their area of responsibility in such a way that the special requirements of data protection and the requirements of the GDPR and the BDSG are met. Technical and organizational measures have been taken to protect data that meet these requirements. TAG Wohnen and TAG are convinced that the measures taken offer an appropriate level of protection for the risks associated with the processing of personal data. The companies observe the principle of data minimization, i.e. only the data that is necessary for the execution and processing of the contracts or that must be retained on the basis of consent and/or legal requirements is collected, processed and retained. Personal data is only received and passed on (e.g. in the case of purchase and sale) on the basis of strict confidentiality agreements and insofar as this is necessary for the processing and execution of transactions.

If you contact us via our websites, for example to find out about rental offers, the data protection information for accessing the website, which is stored on the website itself and can be viewed and downloaded (at tag-wohnen.de or www.tag-ag.com), applies in addition to this data protection information.

TAG Wohnen and TAG reserve the right to supplement and continuously update this data protection notice due to technical developments and the unknown practice of the supervisory authorities. The updated data protection notice shall apply from the date on which it is published on the website.

Information about your right to object in accordance with Article 21 GDPR

Right to object on a case-by-case basis
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) GDPR (data processing in the public interest) and Article 6(1)(f) GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision within the meaning of Article 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Right to object to the processing of data for direct marketing purposes
In individual cases, we process your personal data for direct marketing purposes. You have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to “profiling” insofar as it is associated with such direct advertising.

If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

Recipient of an objection

The objection can be made informally with the subject “Objection”, stating your name, address and date of birth, and should be addressed to:

TAG Immobilien AG
Data Protection Management
Kreuzstraße 7 c, 04103 Leipzig
E-mail: datenschutz@tag-ag.com.

Hamburg, August 13, 2021
TAG Wohnen & Service GmbH