1. Introduction
The protection of your personal data is very important to us, BUWOG Group GmbH, Austria (hereinafter “BUWOG”) and EHL Immobilien GmbH (hereinafter “EHL”). We therefore process personal data only in accordance with the applicable legislation on the protection of personal data, in particular the General Data Protection Regulation (GDPR).
The following data privacy guidelines provide you with an overview of how we process your personal data and of your rights under the data protection legislation. These data privacy guidelines explain whether we process personal data and – if so – the extent to which we do so in connection with the processes mentioned below.
As we develop our website and incorporate new technologies to improve our service for you, there may be changes to these data privacy guidelines. We therefore recommend that you reread these guidelines from time to time.
2. Explanation of terms
The data protection terms used below are defined in Art. 4 of the GDPR. The full text of the GDPR is available on the internet under the following link: https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN
3. Who is responsible for data processing and who can I contact?
3.1 Data controller in accordance with Art. 4 (7) of the GDPR
BUWOG Group GmbH
Hietzinger Kai 131
A-1130 Vienna, Austria
Phone: +43 (0)1/878 28-1130 Fax: +43 (0)1/878 28-5299
E-mail: datenschutz@buwog.com
EHL Immobilien GmbH
Prinz-Eugen-Strasse 8-10
A-1040 Vienna, Austria
Phone: +43 (0)1/512 76 90
Fax: +43 (0)1/512 76 90-20
E-mail: datenschutz@ehl.at
3.2 Contact information for the data protection officer
BUWOG will be pleased to assist you with any questions concerning the topic of data protection. You can reach our data protection officer, Mr Sascha Jung, LL.M. LL.M., as follows:
BUWOG Group GmbH
Data Protection Officer
Attorney-at-Law Sascha Jung, LL.M. LL.M.
Jank Weiler Operenyi Rechtsanwälte GmbH | Deloitte Legal
Schottengasse 1, A-1010 Vienna, Austria
E-mail: datenschutz-buwog@deloitte.at
EHL will be pleased to assist you with any questions concerning the topic of data protection (the contact information can be found under section 3.1). EHL has not appointed a data protection officer because there is no legal need for it.
4. To whom does this data privacy statement apply?
When we process personal data, it means, briefly summarised, that we collect, store, use, transfer or delete this data.
These data privacy guidelines involve personal data pertaining to visitors who browse our website.
5. Which of your data do we process?
When you visit our website, we process web server log files which include the following personal information:
- IP address
- Technical access data
- Date and time of access
- Identification data of the browser/operating system used
- Operating system
- Referrer URL
- Subsite accessed on our website
Furthermore, in connection with the web analytics tracking tool, we process data about your use of our website (for a more detailed description, see section 9).
6. What does BUWOG use your data for (purpose of processing) – and on what legal basis?
We process the aforementioned personal data in accordance with the provisions of the GDPR and the Austrian Data Protection Act (DSG). We also evaluate this data – anonymously – for purely statistical purposes and without any reference to your person, e.g. for the evaluation of the number of page views, duration of use, etc.
The legal basis for the processing of the access data during a visit to the website and in connection with the web analytics tracking tool is our legitimate interest in accordance with Article 6 (1) lit f of the GDPR. We use your data so that you are able to take full advantage of all of the functions of our website and for the needs-based design and optimisation of our website, for without the stated processing it would be impossible for this to be guaranteed.
Right to object to processing
In accordance with Art. 21 (1) of the GDPR, you have the right at any time to lodge an objection to the processing of personal data pertaining to you that takes place on the basis of Art. 6 (1) lit f of the GDPR (data processing for the protection of legitimate interests).
For details on how to exercise this right, see section 12 below.
7. Who receives your data?
We use a marketing agency as an external service provider in order to take advantage of their specific expertise. Insofar as the aforementioned third party is not responsible for the processing of the data transmitted in accordance with Art. 4 (7) of the GDPR, the agency will process your personal data on our behalf under Art. 28 of the GDPR as a processor. Processors only act on instructions from us and are contractually required to comply with the applicable data protection requirements with respect to us.
8. Is data transferred to a third-party country or to an international organisation?
Data is not transferred to countries outside the EU or the EEA (so-called third-party countries).
9. Web analytics with tracking tools (Google Analytics)
We use the web analytics tool described below to analyse the use of our website and improve it on a regular basis. The statistics obtained allow us to improve our services for you and to make them more interesting for you as a user.
Google Analytics uses cookies: these are text files that are stored on your computer and allow an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transferred to a Google server in the USA and stored there. Prior to this, however, your IP address is truncated by Google. Only in exceptional cases is the full IP address sent to a Google server in the USA and truncated there. On behalf of us, Google uses this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services related to the use of the website and the internet.
The IP address sent by your browser to Google Analytics is not merged with other Google data.
You can prevent the storage of cookies by configuring your browser software appropriately; please note, however, that if you do this, you may not be able to take full advantage of all of the features of this website. Furthermore, you can prevent Google from collecting the data which is produced by the cookie and related to your use of the website (including your IP address) as well as from the processing this data by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=en.
This website uses Google Analytics with the extension “_anonymizeIp()”. As a result, IP addresses are processed in truncated form, thereby ruling out any connection with a person. To the extent that the data collected about you is assigned a personal reference, it is immediately excluded and the personal data is deleted without delay.
For exceptional cases in which personal information is transferred to the US, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
Third-party provider information:
Google Dublin, Google Ireland Ltd.
Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001
Further information about data privacy at Google can be found here: http://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats.html. Alternatively, visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org.
10. Data security
Your personal data is protected from external attacks with state-of-the-art technology.
11. How long is my data stored?
Your data is deleted as soon as the respective session has ended. Web server log files are deleted after seven days. Further storage is possible in exceptional circumstances, but in this case the IP addresses of the users are deleted or encrypted so that an assignment of the accessing client is no longer possible.
12. What rights to data privacy do I have?
As a data subject, you have the following rights (“rights of the data subject”) under the GDPR:
- Right of access:
In accordance with Art. 15 of the GDPR, you can request information from us on whether your personal data is processed and what that data is. - Right to rectification:
If your information is incorrect, you can request a correction in accordance with Art. 16 of the GDPR. If your data is incomplete, you can request its completion. - Right to erasure of personal data:
You have the right to delete your data, provided that the requirements of Art. 17 of the GDPR are met (particularly if the purposes for which your data was collected or processed no longer apply). - Right to restriction of processing:
You have the right to restrict the processing of your data, provided that the requirements of Art. 18 of the GDPR are met. - Right to data portability:
If you wish, we will also provide you with your data for further use or transmit it to a recipient designated by you. - Right to revocation of consent:
If consent has been given to process the personal data, the right to revoke the consent granted at any time with future effect shall apply, i.e. the revocation does not affect the legality of the processing carried out prior to the revocation on the basis of consent. - Right to object to processing:
In accordance with Art. 21 (1) of the GDPR, you have the right at any time to object to the processing of personal data on the basis of Art. 6 (1) lit f of the GDPR (data processing to safeguard legitimate interests).If you object, we will no longer process your personal data for the purposes covered by the objection, unless
– we can demonstrate compelling legitimate reasons that override the interests, rights and freedoms of the data subject, or
– the processing serves the establishment, exercise or defence of legal claims.
Insofar as the objection is also or only directed against the processing of data for direct advertising, we will no longer process your personal data for this purpose.The objection can be can be made informally by a message to the contact details mentioned under section 3.1 or 3.2. - Right to lodge a complaint:
In addition, there is a right to lodge a complaint with the Austrian Data Protection Authority (Art. 77 of the GDPR in connection with section 24 of the Austrian Data Protection Act.
However, we recommend that you first direct a complaint to our data protection officer. The contact details can be found under section 3.1 or 3.2.
