Privacy

Name and address of the data controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national privacy legislation of the Member States and of other provisions under privacy legislation is:

FOM Real Estate GmbH
Prof. Reinhard Walter
Managing Partner
Friedrich-Ebert-Anlage 22
69117 Heidelberg
Telephone: +49 (0) 62 21 – 36 36 6-0
Telefax: +49 (0) 62 21 – 36 36 6-66
info@fom-hd.de
fomrealestate.de
VAT ID no. DE 187249631
Handelsregister (commercial register): Registergericht (register court) Mannheim HRB 335691

General information on data processing
Scope of processing of personal data
We only process the personal data of our users to the extent that this is required to provide a fully functioning website and our content and services. Generally speaking, the personal data of our users is processed only with the consent of the user. An exception will apply in such cases where it is not possible to obtain consent in advance for practical reasons and the processing of the data is permitted by law.

Legal basis for the processing of personal data
Article 6(1)(a) GDPR will provide the legal basis where the consent of the data subject is required for the processing of personal data.

Article 6(1)(b) GDPR will provide the legal basis where the processing of personal data is required for the fulfilment of a contract where a contracting party is the data subject. This will also apply to processing operations that are required for the execution of pre-contractual measures.

Article 6(1)(c) GDPR will provide the legal basis where the processing of personal data is required for the fulfilment of a legal obligation to which our company is subject.

Article 6(1)(d) GDPR will provide the legal basis in the case that the vital interests of the data subject or of another natural person require the processing of personal data.

Article 6(1)(f) GDPR will provide the legal basis where processing is required to safeguard the legitimate interests of our company or of a third party and where the interests, fundamental rights and basic freedoms of the data subject do not prevail over the interests of the former.

Data deletion and duration of storage
The personal data of the data subject will be deleted as soon as the purpose of the storage no longer applies. Beyond that, data may be stored if this is provided for by the European or national legislator in EU Regulations, laws or other legislation to which the controller is subject. The data may even be blocked or deleted on the expiry of a storage period stipulated in one of the above-mentioned pieces of legislation, unless the storage of the data is required for the purpose of the conclusion or fulfilment of a contract.

Provision of the website and creation of log files
Description and scope of data processing**

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The data are collected by our hosting provider, STRATO AG, Pascalstraße 10, 10587 Berlin, with whom we have concluded an agreement on data processing on behalf (AVV). The following data will be collected:

– Information about the type of browser and the version used
– the user’s operating system
– the user’s internet service provider
– the user’s IP address
– date and time of access
– websites from which the user’s system accesses our website
– websites that are accessed by the user’s system via our website

IP addresses will be stored only to the extent that is required to deliver the website. Otherwise, IP addresses will be deleted or anonymised. The IP addresses collected during a visit to the website will be stored by STRATO for a maximum of 7 days to allow for the recognition of and defence against attacks.

Legal basis for data processing
Article 6(1)(f) GDPR provides the legal basis for the temporary storage of data and of log files.

Purpose of data processing
Log files are stored to ensure the proper functioning of the website. In addition, we use the data to optimise our website and to ensure the security of our information systems. The data will not be analysed here for marketing purposes.

Duration of storage
The IP addresses collected when our website is accessed will be stored with united-domains for a maximum period of 7 days to allow for the recognition of and defence against attacks.

Option of objection and removal
It is absolutely vital for the operation of the website that data are collected to enable the provision of the website and that the data are stored in log files. Consequently, there is no possibility of objecting on the part of the user.

Use of cookies
Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in or by the internet browser on the user’s computer. When a user accesses a website, a cookie may be stored in the operating system of the user. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is accessed again.

Legal basis for the data processing
Article 6(1)(f) GDPR will provide the legal basis for the processing of personal data when using cookies.

Purpose of the data processing
The reason for using technically required cookies is to simplify the use of websites for users. Some of the functions of our website cannot be provided without the use of cookies. It is necessary for them to recognise the browser again, even after a change of website.

Duration of storage, option of objection and removal
Cookies are stored on the user’s computer and are transmitted from there to our website. For this reason, as a user you have full control over the use of cookies. You may deactivate or restrict the transmission of cookies by changing the settings in your internet browser. Stored cookies can be deleted at any time. This can also happen automatically. If cookies are deactivated for our website, it may not be possible to make full use of all the functions of our website.

Google Analytics
This website uses Google Analytics, a web analytics service of Google Inc. (“Google”). Google Analytics uses “cookies”, which are text files that are stored on your computer and that allow for the analysis of your use of the website. The information generated by the cookie about the use of this website by the user is generally transmitted to a Google server in the USA and is stored there. This website uses IP anonymisation, which means that your IP address will be truncated by Google within the Member States of the European Union and in other contracting States to the Agreement on the European Economic area prior to transmission. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the provider to evaluate your use of our website, to prepare reports about such website activity and to provide the website operator with information about additional services related to the use of the website and the World Wide Web.

The IP address transmitted by your browser as part of Google Analytics will not be associated with other data from Google. You may prevent the storage of cookies by changing the settings in your browser software; however, we would like to point out that in that case you may not be able to fully use all the functions of the website. In addition, you may prevent the collection for Google of the data (incl. your IP address) generated by the cookie and relating to your use of the website and also the processing of this data by Google by downloading and installing the browser plugin available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).

For further information, please see http://tools.google.com/dlpage/gaoptout?hl=de or http://www.google.com/intl/de/analytics/privacyoverview.html (general information on Google Analytics and privacy). We would like to point out that this website uses Google Analytics with the extension “gat._anonymizeIp();” in order to ensure the anonymised collection of IP addresses (referred to as IP masking).

Use of script libraries (web fonts)
In order to present our content correctly and in a visually appealing way across all browsers, we use the script libraries and fonts libraries of Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801 USA.

Accessing script libraries and font libraries automatically triggers a link to the operator of the library, the Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801 USA. It is possible, in theory, that the operator of the library in question collects data.
According to its own statement, Monotype Imaging Holdings Inc., a Delaware corporation with its principal offices at 600 Unicorn Park Drive, Woburn, Massachusetts 01801 USA, does not collect personal data.

The privacy policy of the library operator can be accessed at the following link: https://www.monotype.com/legal/privacy-policy/web-font-tracking-privacy-policy/

Contact by email
Description and scope of data processing
Contact via email addresses possible. In this case the personal data transmitted in an email will be stored. In this regard, the data will not be disclosed to third parties. The data will be used exclusively for processing the conversation.

Legal basis for the processing of personal data
Article 6(1)(f) GDPR will provide the legal basis for processing the data that are transmitted in the course of the transmittance of an email. Article 6(1)(b) GDPR will provide the additional legal basis for processing where the purpose of the email contact is the conclusion of a contract.

Purpose of data processing
The use of contact email addresses is solely for the purpose of processing the establishment of contact. In the case of establishment of contact by email, this also constitutes the necessary legitimate interest in the processing of the data.

Duration of storage
The data will be deleted as soon as they are no longer required to achieve the purpose of their collection. This is then the case for personal data transmitted by email if the relevant conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the facts in question have been conclusively clarified.

Option of objection and removal
The user has the option at all times to withdraw his consent to the processing of personal data. If the user makes contact with us by email, he may object to the storage of his personal data at any time. In such an event, the conversation cannot be continued.
In this case, all personal data that were stored in the course of establishing contact will be deleted.
 
Rights of the data subject

Right of access
You may request confirmation from the data controller as to whether your personal data are being processed by us.

If such processing is being carried out, you may request access to the following information from the data controller:
(1) the purposes for which the personal data are being processed;
(2) the categories of personal data that are being processed;
(3) the recipients or the categories of recipients to whom your personal data were or will be disclosed;
(4) the planned duration of the storage of your personal data or, if concrete details are not possible here, the criteria for determining the duration of the storage;
(5) the existence of a right to rectification or erasure of your personal data, the right to the restriction of processing by the data controller or the right to object to such processing;
(6) the existence of a right to lodge a complaint with a supervisory authority;
(7) all available information about the origin of the data if the personal data were not collected from the data subject;
(8) the existence of automated decision making including profiling pursuant to Article 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved and the intended effect of such processing for the data subject.
You have the right to request information about whether your personal data has been transmitted to a third country or to an international organisation. In this regard, in accordance with Article 46 GDPR you may request to be notified about appropriate safeguards in connection with the transmission.

Right to rectification
You have the right to obtain from the controller rectification and/or to have incomplete data completed, provided the processed personal data that concern you are inaccurate or incomplete. The data controller shall carry out the rectification without delay.

Right to restriction of processing
You may request the restriction of processing of your personal data under the following conditions:
(1) You are contesting the accuracy of your personal data for a period enabling the controller to verify the accuracy of the personal data;
(2) Processing is unlawful and you are opposing the erasure of the personal data and requesting the restriction of their use instead;
(3) The controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
(4) You have objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override your grounds.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Where processing has been restricted in line with the above-mentioned conditions, you will be notified by the controller prior to the restriction being lifted.

Right to erasure
Obligation to erase
You have the right to obtain from the controller the erasure of your personal data without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(1) Your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(2) You withdraw consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a), and where there is no other legal grounds for the processing;
(3) You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR;
(4) Your personal data have been unlawfully processed.
(5) Your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
(6) Your personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Disclosure to third parties
Where the controller has made your personal data public and is obliged pursuant to Article 17(1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as a data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Exceptions
The right to erasure does not exist if the processing is necessary

(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
(5) for the establishment, exercise or defence of legal claims.

Right to notification
Where you have obtained the right to rectification, erasure or restriction of processing from the controller, the controller shall communicate any rectification or erasure of your personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right to obtain from the controller information about these recipients.

Right of data portability
You shall have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format. In addition, you shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
(1) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or to a contract pursuant to Article 6(1)(b) GDPR, and
(2) the processing is carried out by automated means.
In exercising this right you furthermore have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be affected by this.
The right to data portability shall not apply to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object
You shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; including profiling based on those provisions.
The controller shall no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or processing is for the purpose of the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Right to withdraw declaration of consent with regard to privacy
You have the right to withdraw your declaration of consent with regard to privacy at any time. The withdrawal of consent does not affect the lawfulness of any processing carried out based on consent up to the time of the withdrawal of consent.

Automated individual decision making including profiling

We do not carry out automated decision making or profiling.

Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.