Privacy Policy We appreciate your visit to our website www.garcia-immobilien.de and your interest in our company. The protection of your personal data—such as your date of birth, name, phone number, address, etc.—is very important to us. The purpose of this Privacy Policy is to inform you about the processing of your personal data that we collect when you visit our website. Our data protection practices comply with the legal provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The following Privacy Policy serves to fulfill the information obligations arising from the GDPR. These can be found, for example, in Art. 13 and Art. 14 et seq. of the GDPR. Data Controller The data controller within the meaning of Art. 4(7) of the GDPR is the entity that, alone or jointly with others, determines the purposes and means of the processing of personal data. With regard to our website, the data controller is: Garcia & Co. Immobilien GmbH Ennester Straße 9 57439 Attendorn Germany Email: info@garcia-immobilien.de Phone: 0 27 22 / 93 720 Fax: 0 27 22 / 93 72 22 Contact Information for the Data Protection Officer We have appointed a Data Protection Officer in accordance with Art. 37 of the GDPR. You can contact our Data Protection Officer using the following contact information: ituso GmbH Fraunhoferstraße 9 85221 Dachau Germany Email: datenschutz@garcia-immobilien.de Phone: +49 8142 42050-20 Website Provision and Creation of Log Files Each time our website is accessed, our system automatically collects data and information about the device used to access it (e.g., computer, cell phone, tablet, etc.). What personal data is collected, and to what extent is it processed? (1) Information about the browser type and version used; (2) The operating system of the accessing device; (3) Hostname of the accessing computer; (4) The IP address of the accessing device; (5) Date and time of access; (6) Websites and resources (images, files, other page content) accessed on our website; (7) Websites from which the user’s system accessed our website (referrer tracking); (8) Indication of whether the request was successful; (9) Amount of data transferred This data is stored in our system’s log files. This data is not stored together with the personal data of a specific user, meaning that individual website visitors cannot be identified. Legal Basis for the Processing of Personal Data Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest consists in ensuring that the purpose described below is achieved. Purpose of Data Processing The temporary (automated) storage of the data is necessary for the course of a website visit to enable the website to be displayed. The storage and processing of personal data also serve to maintain the compatibility of our website for as many visitors as possible, as well as to combat misuse and resolve malfunctions. For this purpose, it is necessary to log the technical data of the accessing computer in order to respond as quickly as possible to display errors, attacks on our IT systems, and/or errors in the functionality of our website. In addition, we use the data to optimize the website and to generally ensure the security of our IT systems. Retention Period The aforementioned technical data is deleted as soon as it is no longer needed to ensure the website’s compatibility for all visitors, but no later than 3 months after the website is accessed. Right to Object and Right to Erasure You may object to the processing at any time in accordance with Art. 21 of the GDPR and request the erasure of data in accordance with Art. 17 of the GDPR. You can find information about your rights and how to exercise them at the bottom of this Privacy Policy. Special Features of the Website Our website offers various features; when you use these features, we collect, process, and store personal data. Below, we explain what happens to this data: Booking Request Form What personal data is collected, and to what extent is it processed? We will process the data you enter into our booking request form (date, number of people, etc.) to fulfill the following purpose. Legal basis for the processing of personal data Art. 6(1)(b) GDPR (Implementation of (pre-)contractual measures) Purpose of Data Processing The pre-contractual exchange of information is necessary to review your booking so that we can prepare for a possible subsequent conclusion of a contract. Retention period The data will be deleted as soon as it is no longer needed to process the booking and there are no longer any legal retention requirements. Right to object and right to erasure You can find information about your rights and how to exercise them at the bottom of this Privacy Policy. Required nature of providing personal data The information requested in the booking request form is not required by contract or by law, but it is necessary for us to process your booking properly. If you do not fill out the required fields or do not fill them out completely, we will not be able to process your booking request. Callback Service What personal data is collected, and to what extent is it processed? We will process the data you enter into our callback form—such as your phone number and name—to fulfill the following purpose. Legal Basis for the Processing of Personal Data Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR (consent through a clear affirmative action or conduct, or explicit consent) Purpose of Data Processing The purpose of data processing is to provide and carry out the callback service or to fulfill the callback request. Retention period The data will be deleted as soon as it is no longer necessary for processing your callback request. Right to withdraw consent and request deletion You may withdraw your consent to be contacted at any time in accordance with Art. 7(3) of the GDPR. However, this does not affect the processing that took place prior to the withdrawal. With regard to your other rights, please refer to the overview at the end of this Privacy Policy. Necessity of Providing Personal Data We will process all data you enter into our callback form—in particular, the message you compose and other details such as your name, pseudonym, or email address—to fulfill the purpose described below. Contact Form(e) What personal data is collected, and to what extent is it processed? We will process the data you enter into our contact forms—specifically, the information you enter into the contact form’s input fields—to fulfill the purpose described below. Legal Basis for the Processing of Personal Data Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR (consent through a clear affirmative action or conduct, or explicit consent) Purpose of Data Processing We will use the data collected via our contact form(s) solely for the purpose of processing the specific contact inquiry received through the contact form. Retention Period After your inquiry has been processed, the collected data will be deleted immediately, provided there are no statutory retention periods. Right to Withdraw Consent and Request Deletion The options for withdrawing consent and requesting deletion are governed by the general provisions regarding the right to withdraw consent and the right to erasure under data protection law, as described later in this Privacy Policy. Requirement to Provide Personal Data The use of the contact forms is voluntary and is not required by contract or by law. You are not obligated to contact us via the contact form; instead, you may also use the other contact options listed on our website. If you wish to use our contact form, you must fill out the fields marked as required. If you do not provide the necessary information in the contact form, you will either be unable to submit the request, or we will unfortunately be unable to process your request. Login Area What personal data is collected, and to what extent is it processed? We will process the registration and login data you provide to us to fulfill the purpose stated below. Legal basis for the processing of personal data Art. 6(1)(b) GDPR (Implementation of (pre)contractual measures) Purpose of data processing You have the option to use a separate login area on our website. To allow us to verify your authorization to access the restricted area or the protected documents, you must enter your login credentials (email address or username and password) into the corresponding form. Retention Period The collected data will be stored for as long as you maintain a user account with us. Right to Object and Right to Erasure You can find information about your rights and how to exercise them at the bottom of this Privacy Policy. Requirement to Provide Personal Data Use of the login area on our website is contractually required to access the protected area. Access to the content protected by the login area is not possible without providing personal data. If you wish to use our login area, you must fill out the fields marked as required (username and password). Entering this information requires that you have a user account. You cannot log in if the information you enter is incorrect. If the information you provide is incorrect or not entered at all, you will not be able to access the protected area. However, the rest of the site remains accessible without logging in. Newsletter Sign-Up Form What personal data is collected, and to what extent is it processed? When you sign up for the newsletter on our website, we receive the email address you enter in the sign-up field and, if applicable, additional contact information, provided you share this with us via the newsletter sign-up form. Legal basis for the processing of personal data Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR (consent through a clear affirmative action or conduct, or explicit consent) Purpose of data processing We use the data collected in our newsletter sign-up form exclusively to send our newsletter, in which we provide information about all our services and news. After you sign up, we will send you a confirmation email containing a link that you must click to complete your subscription to our newsletter (double opt-in). Duration of Storage You can unsubscribe from our newsletter at any time by clicking the unsubscribe link, which is also included in every newsletter. We will delete your data immediately after you unsubscribe. Likewise, we will delete your data immediately if the sign-up process is not completed. We reserve the right to delete your data without providing reasons and without prior or subsequent notice. Right to Withdraw Consent and Right to Erasure You may withdraw your consent at any time in accordance with Art. 7(3) of the GDPR. However, this does not affect any processing that took place prior to the withdrawal. With regard to your other rights, please refer to the overview at the end of this Privacy Policy. Requirement to Provide Personal Data If you wish to subscribe to our newsletter, you must fill out the fields marked as required and confirm your email address by clicking the double opt-in link. The information required for newsletter registration is neither necessary to enter into a contract with us nor required by law. It is used exclusively for sending our newsletter. If you do not provide the required information, we unfortunately cannot provide you with our newsletter service. Automated Credit Check / Scoring If you wish to enter into a contract with us, we reserve the right to process your personal data exclusively by automated means in order to verify your creditworthiness. We are also authorized to make such an automated decision pursuant to Art. 22(2)(a) of the GDPR. Whether or not the contract can be concluded depends on the result of the automated credit check. A credit check calculates the statistical probability of a payment default. The credit report may include probability values (score values) calculated using scientifically recognized mathematical and statistical methods. These methods use a variety of factors—such as income, address information, occupation, marital status, and past payment history, to assess the customer’s future risk of default. The result is expressed as a payment value (a so-called “score”). The information obtained in this way forms the basis for our decision regarding the establishment, execution, or termination of a contractual relationship. If you believe that you have been wrongfully excluded from entering into a contract as a result of the credit check, you are welcome to explain your position to us via email. We will then review the automated decision in accordance with Art. 22( 3 of the GDPR in the specific individual case. In order to conduct the credit check, we are permitted to store and process your personal data in accordance with Article 6(1)(b) of the GDPR. Based on the pending contract, we will transfer your data to the following provider(s) in the cases listed below: infoscore Consumer Data GmbH: infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden, Germany (http://ttps//www.experian.de): Our company regularly checks your creditworthiness when concluding contracts and, in certain cases where there is a legitimate interest, also for existing customers. To this end, we collaborate with infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden, Germany, from whom we obtain the necessary data. For this purpose, we transmit your name and contact information to infoscore Consumer Data GmbH. Statistical Analysis of Visits to This Website – Web Trackers When you access this website or individual files on the website, we collect, process, and store the following data: IP address, the website from which the file was accessed, the name of the file, date and time of access, amount of data transferred, and a notification regarding the success of the access (so-called web log). We use this access data exclusively in a non-personalized form to continuously improve our website and for statistical purposes. We also use the following web trackers to analyze visits to this website: Google On our site, we use the Google service provided by Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland, email: support-deutschland@google.com, website: https://www.google.com/. Personal data is also transferred to the United States. With regard to the transfer of personal data to the United States, there is an adequacy decision regarding the EU-US Data Privacy Framework issued by the European Commission pursuant to Article 45 of the GDPR (hereinafter: DPF—https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). The service provider is certified under the DPF, meaning that the standard level of protection provided by the GDPR applies to the transfer. The legal basis for the processing of personal data is your consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, which you provided on our website. We use Google to load additional Google services on the website. The service is used to provide additional Google services, such as the data processing required for the delivery of streams and fonts, as well as relevant Google Search results. It is technically necessary to exchange information about the website visitor—which Google already has—between Google services and to provide the website visitor with personalized content tailored to their Google Account. For the processing itself, the service or we collect the following data: background data stored in the Google user account or with other Googleservices regarding the website visitor, background data for the provision of Google services (e.g., streaming data or advertising data), data regarding the website user’s interaction with Google Search, information about the user’s device, IP address, and browser, and additional data from Google services required for the provision of Google services related to our website. If the service is actively enabled on our website, our website establishes a connection to the servers of Google Ireland Limited and transmits the necessary data. As part of data processing on behalf of Google, personal data may also be transferred to the servers of Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States. When the Google service is used on our website, Google may transmit and process information from other Google services to provide background services for the display and data processing of the services provided by Google. To this end, data may also be transmitted to the Google services Google APIs, DoubleClick, Google Cloud, as well as Google Ads and Google Fonts, in accordance with the Google Privacy Policy. You can view the provider’s certification under the EU-U.S. Data Privacy Framework at https://www.dataprivacyframework.gov/list. You may revoke your consent at any time. For more information on revoking your consent, please refer to the consent form itself or the end of this Privacy Policy. Further information on the handling of the transferred data can be found in the provider’s Privacy Policy at https://policies.google.com/privacy. The provider also offers an opt-out option at https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=de. Gstatic On our website, we use the Gstatic service provided by Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland, email: support-deutschland@google.com, website: https://www.google.com/. Personal data is also transferred to the United States. With regard to the transfer of personal data to the United States, an adequacy decision has been issued by the EU Commission regarding the EU-US Data Privacy Framework pursuant to Article 45 of the GDPR (hereinafter: DPF—https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). The service provider is certified under the DPF, meaning that the standard level of protection provided by the GDPR applies to such transfers. The legal basis for the processing of personal data is your consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, which you provided on our website. Gstatic is a background service used by Google to retrieve static content in order to reduce bandwidth usage and preload necessary catalog files. In particular, the service loads background data for Google Fonts and Google Maps. As part of data processing on behalf of the controller, personal data may also be transferred to the servers of Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States. You can view the provider’s certification under the EU-U.S. Data Privacy Framework at https://www.dataprivacyframework.gov/list. You may revoke your consent at any time. Further information on revoking your consent can be found either in the consent form itself or at the end of this privacy policy. Further information on how the transferred data is handled can be found in the provider’s privacy policy at https://policies.google.com/privacy. The provider also offers an opt-out option at https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=de. Matomo (local) We use the Matomo (local) service on our website, provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, email: privacy@matomo.org, website: https://matomo.org/. Personal data is transmitted exclusively to servers located in the European Union. The legal basis for the processing of personal data is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. Our legitimate interest lies in achieving the purpose described below. Matomo is hosted on our own server infrastructure and configured by us in such a way that no data is transferred to Matomo, InnoCraft Ltd., or any other third parties. The collection of statistical data serves to monitor the functionality and user-friendliness of our website and to optimize it by analyzing anonymized user traffic. This allows us to identify which content is relevant to our website visitors and users and to expand our offerings accordingly. We can also use the collected data to create anonymous usage profiles and derive general statistical information. The data collected in this context is not combined with other personal data without separate consent. For the processing itself, the service—or we—collect the following data: parts of your IP address in anonymized form, user activities (e.g., referrer links, time spent on specific URLs, clickstream, shopping cart or order IDs), data about your browser settings, browser provider, browser version, screen resolution, and the operating system used. Data collection by our local Matomo instance is also configured to be privacy-friendly. Collected IP addresses are anonymized prior to collection and processing. We have also enabled the “Do Not Track Preference” in Matomo. This ensures that a “Do Not Track” request from your browser is honored by Matomo when you visit our website and, regardless of any other measures we may take, the website user is not tracked. You can prevent tracking by Matomo at any time by enabling the “Do Not Track” setting in your browser. With regard to data processing, you have the right to object as set forth in Article 21. Further information can be found at the end of this Privacy Policy. Additional information on how the transferred data is handled can be found in the provider’s Privacy Policy at https://matomo.org/faq/general/faq_18254/. YouTube We use the YouTube service on our website, provided by Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland, email: support-deutschland@google.com, website: https://www.google.com/. Personal data is also transferred to the United States. With regard to the transfer of personal data to the United States, there is an adequacy decision by the European Commission regarding the EU-US Data Privacy Framework pursuant to Art. 45 of the GDPR (hereinafter: DPF—https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). The service provider is certified under the DPF, meaning that the standard level of protection under the GDPR applies to the transfer. The legal basis for the processing of personal data is your consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, which you provided on our website. Videos from the YouTube platform are embedded on our site via the YouTube service. This integration allows us to display videos directly on our website. In this way, site visitors can view information about our services without having to visit the YouTube platform. For the processing itself, the service or we collect the following data: Data related to displaying the stream, data on videos clicked, playlists created, ratings and comments, information about the user’s device, IP address, and browser, as well as additional data from Google services required to provide the video in accordance with the Google Privacy Policy If YouTube is actively enabled on our website and a video is played, our website establishes a connection to the servers of Google Ireland Limited and transmits the data required to display the stream or video. As part of data processing on behalf of a client, personal data may also be transferred to the servers of Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States. Personal data is also transferred to the United States. With regard to the transfer of personal data to the United States, there is an adequacy decision by the European Commission regarding the EU-US Data Privacy Framework pursuant to Article 45 of the GDPR (hereinafter: DPF—https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). The service provider is certified under the DPF, meaning that the standard level of protection provided by the GDPR applies to the transfer. When YouTube videos are displayed on our website, YouTube may transmit and process information from other Google services in order to provide background services for the video, such asstreaming data. To this end, data may also be transferred to the Google services Google Fonts, Google APIs, Google Video, and DoubleClick. You can view the provider’s certification under the EU-U.S. Data Privacy Framework at https://www.dataprivacyframework.gov/list. You may revoke your consent at any time. For more information on revoking your consent, please refer either to the consent form itself or to the end of this privacy policy. Further information on the handling of the transferred data can be found in the provider’s privacy policy at https://policies.google.com/privacy. The provider also offers an opt-out option at https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=de. Integration of External Web Services and Processing of Data Outside the EU On our website, we use active content from external providers, known as web services. When you visit our website, these external providers may receive personal information about your visit to our website. In some cases, this may involve the processing of data outside the EU. You can prevent this by installing an appropriate browser plugin or by disabling the execution of scripts in your browser. This may result in limited functionality on the websites you visit. We use the following external web services: Google Cloud APIs On our website, we use the Google Cloud APIs service provided by Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland; email: support-deutschland@google.com; website: https://www.google.com/. Personal data is also transferred to the United States. With regard to the transfer of personal data to the United States, there is an adequacy decision by the European Commission regarding the EU-US Data Privacy Framework pursuant to Art. 45 of the GDPR (hereinafter: DPF—https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). The service provider is certified under the DPF, meaning that the standard level of protection provided by the GDPR applies to the transfer. The legal basis for the processing of personal data is your consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, which you provided on our website. We use Google APIs to load additional Google services on our website. Google APIs are a collection of interfaces that enable communication between the various Google services used on our website. The service is used in particular to display Google Fonts and to provide Google Maps. For the processing itself, the service—or rather, we—collect the following data: IP address If the service is active on our website, our website establishes a connection to the servers of Google Ireland Limited and transmits the necessary data. As part of order processing, personal data may also be transferred to the servers of Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States. When the Google service is used on our website, Google may transmit and process information from other Google services in order to provide background services for the display and data processing of the services provided by Google. For this purpose, data may also be transferred to the Google services Google Cloud, Google Maps, Google Ads, and Google Fonts in accordance with Google’sPrivacy Policy, with Google bearing responsibility under data protection law. You can view the provider’s certification under the EU-U.S. Data Privacy Framework at https://www.dataprivacyframework.gov/list. You may withdraw your consent at any time. For more information on withdrawing your consent, please refer either to the consent form itself or to the end of this Privacy Policy. For more information on how the transferred data is handled, please see the provider’s privacy policy at https://policies.google.com/privacy. The provider also offers an opt-out option at https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=de. Google Fonts On our website, we use the Google Fonts service provided by Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland; email: support-deutschland@google.com; website: https://www.google.com/. Personal data is also transferred to the United States. With regard to the transfer of personal data to the United States, an adequacy decision has been issued by the European Commission regarding the EU-US Data Privacy Framework pursuant to Article 45 of the GDPR (hereinafter: DPF—https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). The service provider is certified under the DPF, meaning that the standard level of protection provided by the GDPR applies to the transfer. The legal basis for the processing of personal data is your consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, which you provided on our website. We use the Google Fonts service to incorporate attractive fonts into our site so that we can display our website to you in a more visually appealing format. The service may also be used on our website if other Google services are loaded on our website that require Google Fonts to function. This is the case, for example, when our website uses Google services that absolutely require Google Fonts to function. For the processing itself, the service—or we—collect the following data: data related to fonts, the website visitor’s IP address, statistics on font usage, and additional data from Google services related to our website. If the service is active on our website, our website establishes a connection to the servers of Google Ireland Limited and transmits the required data. As part of data processing on behalf of others, personal data may also be transferred to the servers of Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States. When the Google service is used on our website, Google may transmit and process information from other Google services in order to provide background services for the display and data processing of the services provided by Google. For this purpose, data may also be transferred to the Google services Google APIs, Google Cloud, and Google Ads in accordance with the Google Privacy Policy. You can view the provider’s certification under the EU-US Data Privacy Framework at https://www.dataprivacyframework.gov/list. You may withdraw your consent at any time. For more information on withdrawing your consent, please refer either to the consent form itself or to the end of this Privacy Policy. For more information on how the transferred data is handled, please see the provider’s privacy policy at https://policies.google.com/privacy. The provider also offers an opt-out option at https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=de. IWA - Suite On our website, we use the IWA - Suite service provided by ZwoVadis GmbH, Brachenfelder Str. 45, 24534 Neumünster, Germany; email: info@immobilienwertanalyse.de; website: https://www.immobilienwertanalyse.de/. Personal data is transmitted exclusively to servers located in the European Union. The legal basis for the processing of personal data, in accordance with Article 6(1)(b) of the GDPR, is the contract already concluded or to be concluded between you and us. The plugin from immobilienwertanalyse.de enables users to accurately assess the value of their properties based on various parameters such as location, size, and amenities. It provides detailed information to help you make informed decisions when buying, selling, or renting real estate. You can find information about your rights regarding data processing at the end of this privacy policy. For more information on how the transferred data is handled, please refer to the provider’s privacy policy at https://www.immobilienwertanalyse.de/datenschutz/. Legal Text Snippet and Modules On our site, we use the “Legal Text Snippet and Modules” service provided by Website-Check GmbH, Beethovenstraße 24, 66111 Saarbrücken, Germany, email: support@website-check.de, website: https://www.website-check.de/. Personal data is transmitted exclusively to servers within the European Union. The legal basis for processing is Article 6(1)(c) of the GDPR. Using this service helps us fulfill our legal obligations. With the help of this service, the content of our legal texts is loaded onto our website. The integration on our site ensures that the most current legal texts are loaded. Through this integration, additional technical modules related to the legal texts or legally required elements may also be loaded, if necessary. You can find information about your rights regarding this processing at the end of this privacy policy. For more information on how the transferred data is handled, please refer to the provider’s privacy policy at https://www.website-check.de/datenschutzerklaerung/. Superchat We use the Superchat service on our website, provided by SuperX GmbH, Schönhauser Allee 180, 10119 Berlin, Germany, email: hello@superchat.de, website: https://www.superchat.de/. Personal data is transmitted exclusively to servers located in the European Union. The legal basis for the processing of personal data is your consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, which you provided on our website. The service facilitates organized communication between companies and customers across various platforms. You may withdraw your consent at any time. You can find more detailed information on revoking your consent either in the consent form itself or at the end of this privacy policy. Further information on how the transferred data is handled can be found in the provider’s privacy policy at https://www.superchat.de/datenschutz. The provider also offers an opt-out option at https://www.superchat.de/datenschutz. Website-Check Seal We use the Website-Check Seal service on our site, provided by Website-Check GmbH, Beethovenstraße 24, 66111 Saarbrücken, Germany, email: support@website-check.de, website: https://www.website-check.de/. Personal data is transmitted exclusively to servers within the European Union. The legal basis for the processing of personal data is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR. Our legitimate interest lies in achieving the purpose described below. The script provided by Website-Check GmbH involves the technical integration of the Website-Check Seal. With this seal, we wish to demonstrate that we take data protection very seriously. Data is transmitted to Website-Check GmbH for the purpose of delivering and displaying the seal on our site. With regard to this processing, you have the right to object as set forth in Article 21. Further information can be found at the end of this privacy policy. Further information on how the transferred data is handled can be found in the provider’s privacy policy at https://www.website-check.de/datenschutzerklaerung/. Ynfinite On our site, we use the Ynfinite service provided by Ypsolution GmbH, Overstolzenstr. 2a, 50677 Cologne, Germany, website: https://www.ynfinite.de/. Personal data is transmitted exclusively to servers located within the European Union. The legal basis for the processing of personal data is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in achieving the purpose described below. The service is part of the “Ynfinite” CMS provided by Ypsolution. Without this functionality, our website cannot be delivered or displayed correctly. Ynfinite processes only personal data that is absolutely necessary for the operation of the website, including the IP address. The IP address is required to establish a connection to Ynfinite’s servers so that the website pages, images, and scripts can be loaded. After the connection is established, the IP address is stored only in log files retained for a short period for troubleshooting purposes and is subsequently discarded. With regard to this processing, you have the right to object as set forth in Article 21. Further information can be found at the end of this privacy policy. Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://www.ynfinite.de/datenschutz.html. Notice Regarding the Use of Cookies What personal data is collected, and to what extent is it processed? We integrate and use cookies on various pages to enable certain functions of our website and to integrate external web services. “Cookies” are small text files that your browser can store on your device. These text files contain a unique string of characters that uniquely identifies your browser when you return to our website. The process of storing a cookie file is also referred to as “setting a cookie.” Cookies can be set both by the website itself and by external web services. Cookies are set by our website or the external web services to maintain the full functionality of our website, improve user-friendliness, or to fulfill the purpose specified with your consent. Cookie technology also enables us to recognize individual visitors using pseudonyms, such as an individual or random ID, so that we can offer more personalized services. Details are listed in the table below. Legal Basis for the Processing of Personal Data To the extent that cookies are processed on the basis of consent pursuant to Art. 6(1)(a) of the GDPR, this consent also constitutes consent within the meaning of § 25(1) of the TDDDG for setting the cookie on the user’s device. To the extent that another legal basis under the GDPR is specified (e.g., for the performance of a contract or to comply with legal obligations), the storage or placement is based on an exception under Section 25(2) of the TDDDG. This exception applies “if the sole purpose of storing information on the end-user’s terminal equipment or the sole purpose of accessing information already stored on the end-user’s terminal equipment is to facilitate the transmission of a message via a public telecommunications network” or “if the storage of information in the end user’s terminal equipment or access to information already stored in the end user’s terminal equipment is absolutely necessary so that the provider of a digital service can provide a digital service expressly requested by the user.” The applicable legal basis is set forth in the cookie table provided later in this section. Purpose of Data Processing Cookies are set by our website or external web services to maintain the full functionality of our website, improve user-friendliness, or to fulfill the purpose specified with your consent. Cookie technology also enables us to recognize individual visitors using pseudonyms, such as unique or random IDs, so that we can offer more personalized services. Details are listed in the table below. Storage Duration Our cookies are stored until they are deleted from your browser or, in the case of a session cookie, until the session expires. Details are listed in the table below. Right to Object and Opt-Out You can configure your browser according to your preferences to generally prevent cookies from being set. You can then decide on a case-by-case basis whether to accept cookies or accept them by default. Cookies can be used for various purposes, such as recognizing that your device is already connected to our website (persistent cookies) or saving recently viewed content (session cookies). If you have expressly granted us permission to process your personal data, you may revoke this consent at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of revocation. Cookie Name Server Provider Purpose Legal Basis Retention Period Type LAST_RESULT_ENTRY_KEY www.youtube-nocookie.com YouTube Stores user settings when accessing a YouTube video embedded on other websites. Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR (Consent) Session Convenience TESTCOOKIESENABLED www.youtube-nocookie.com YouTube This cookie is used to track user interaction with embedded content. Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR (Consent) Approx. 110 seconds Analytics _pk_id. www.garcia-immobilien.de Website operator This cookie is a tracking cookie from Matomo. It enables us to track page interactions based on an assigned pseudonymous visitor ID and to compile statistics on user behavior on the website. To this end, it stores and analyzes information about visitors’ actions on the website during the current session, such as the date and time of the first visit, the average time spent on the website, and the total number of visitors to the website. Art. 6(1)(f) GDPR (legitimate interests) approx. 13 months Analytics _pk_ses. www.garcia-immobilien.de Website operator This cookie is a tracking cookie from Matomo. It allows us to track page interactions based on an assigned pseudonymous visitorID and to compile statistics on their user behavior on the website. To this end, it stores and analyzes information about visitors’ actions on the website during the current session, such as the date and time of the first visit, the average time spent on the website, and the total number of visitors to the website. Art. 6(1)(f) GDPR (legitimate interests) approx. 33 minutes Analytics ynfinite-bot-protection www.garcia-immobilien.de Website operator This cookie allows us to save individual convenience settings you have selected and retain them for your current and future visits to the site. Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR (consent) Session Configuration ynfinite-cookies www.garcia-immobilien.de Website operator This cookie stores data regarding when the website visitor accessed the website in order to compile statistical data. Additionally, further data is collected for statistical purposes based on the visit to the site. Art. 6(1)(f) GDPR (legitimate interests) approx. 12 months Analytics ynfinite-session www.garcia-immobilien.de Website operator This cookie allows us to save individual convenience settings you have selected and retain them for your current and future visits to the site. Art. 6(1)(f) GDPR (legitimate interests) Approx. 63 minutes Configuration Data Security and Privacy, Communication via Email Your personal data is protected through technical and organizational measures during collection, storage, and processing so that it is not accessible to third parties. In the case of unencrypted email communication, we cannot guarantee complete data security during transmission to our IT systems, so we recommend encrypted communication or sending information by mail for highly confidential information. Automatic Email Archiving Scope of Personal Data Processing We expressly draw your attention to the fact that our email system uses an automated archiving process. All incoming and outgoing emails are digitally archived in an audit-proof manner through this process. Legal Basis for the Processing of Personal Data Art. 6(1)(c) GDPR (legal obligation). The legal obligation consists of compliance with tax and commercial law requirements (e.g., Sections 146, 147 of the German Fiscal Code (AO), Sections 238, 257 of the German Commercial Code (HGB)). Purpose of Data Processing The purpose of archiving is to comply with tax law (e.g., Sections 146, 147 of the German Fiscal Code (AO)—obligation to retain emails relevant to tax matters) and commercial law requirements (e.g., Sections 238, 257 of the German Commercial Code (HGB)—obligation to archive business correspondence). Duration of Storage Our email correspondence is stored until the expiration of retention obligations under tax and commercial law. The retention period may be up to 10 years. Right to Object and Right to Erasure You may object to the processing at any time pursuant to Art. 21 of the GDPR and request the erasure of data pursuant to Art. 17 of the GDPR. You can find information on your rights and how to exercise them at the bottom of this Privacy Policy. Handling of Job Application Documents If you have any questions regarding our email archiving system, please contact our Data Protection Officer. Please also note that we only accept job application documents in PDF format. Compressed files (WinZip, WinRAR, 7Zip, etc.) are filtered out by our security systems and will not be delivered. We do not accept applications in Word format or other file formats and will delete them unread. Please note that application documents sent via unencrypted email may be opened by third parties before they reach our IT systems. We assume that we may also respond to unencrypted application emails in unencrypted form. If you do not wish this, please let us know in your application email. Right of Access and Requests for Rectification – Erasure & Restriction of Data – Withdrawal of Consent – Right to Object Right of Access You have the right to request confirmation as to whether we process your personal data. If this is the case, you have the right to access the information specified in Article 15(1) of the GDPR, provided that this does not infringe upon the rights and freedoms of others (see Article 15(4) of the GDPR). We will also be happy to provide you with a copy of the data. Right to Rectification Pursuant to Article 16 of the GDPR, you have the right to have us correct any personal data we have on file that may be incorrect (such as your address, name, etc.) at any time. You may also request at any time that we complete the data we have stored about you. Any such corrections will be made without delay. Right to Erasure Pursuant to Article 17(1) of the GDPR, you have the right to have us erase the personal data collected about you if the data is no longer needed; the legal basis for processing has ceased to exist without replacement due to the withdrawal of your consent; you have objected to the processing and there are no legitimate grounds for the processing; your data is being processed unlawfully; a legal obligation requires it, or the data was collected in accordance with Article 8(1) of the GDPR. This right does not apply pursuant to Article 17(3) of the GDPR if the processing is necessary for the exercise of the right to freedom of expression and information; your data was collected based on a legal obligation; the processing is necessary for reasons of public interest; the data is necessary for the establishment, exercise, or defense of legal claims. Right to Restriction of Processing Pursuant to Article 18(1) of the GDPR, you have the right, in certain cases, to request the restriction of the processing of your personal data. This applies if you contest the accuracy of the personal data; the processing is unlawful and you do not consent to erasure; the data is no longer needed for the purpose of processing, but the collected data is necessary for the assertion, exercise, or defense of legal claims; an objection to the processing has been lodged pursuant to Article 21(1) of the GDPR and it is still unclear which interests prevail. Right to Withdraw Consent If you have given us your explicit consent to the processing of your personal data (Article 6(1)(a) GDPR or Article 9(2)(a) GDPR), you may withdraw this consent at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. Right to Object Pursuant to Art. 21 of the GDPR, you have the right to object at any time to the processing of your personal data that was collected on the basis of Art. 6(1)(f) (in the context of a legitimate interest). You are entitled to this right only if there are specific circumstances that preclude the storage and processing of your data. How Can You Exercise Your Rights? You may exercise your rights at any time by contacting us using the contact information below: Garcia & Co. Immobilien GmbH Ennester Straße 9 57439 Attendorn Germany Email: info@garcia-immobilien.de Phone: 0 27 22 / 93 720 Fax: 0 27 22 / 93 72 22 Right to Data Portability Pursuant to Article 20 of the GDPR, you have the right to receive the personal data concerning you. We will provide the data in a structured, commonly used, and machine-readable format. The data may be sent either to you or to a controller designated by you. Upon request, we will provide you with the following data in accordance with Article 20(1) of the GDPR: Data collected on the basis of explicit consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR; Data that we have received from you pursuant to Article 6(1)(b) of the GDPR within the scope of existing contracts; Data that has been processed as part of an automated decision-making process. We will transfer the personal data directly to a controller of your choice, provided this is technically feasible. Please note that, pursuant to Article 20(4) of the GDPR, we are not permitted to transfer data that would infringe upon the freedoms and rights of other individuals. Right to lodge a complaint with the supervisory authority pursuant to Article 77(1) of the GDPR If you suspect that your data is being processed unlawfully on our part, you may, of course, seek judicial clarification of the matter at any time. In addition, you may pursue any other legal remedies available to you. Irrespective of this, pursuant to Article 77(1) of the GDPR, you have the option to contact a supervisory authority. You have the right to lodge a complaint pursuant to Article 77 of the GDPR in the EU Member State where you reside, where you work, oror the location of the alleged infringement; that is, you may choose the supervisory authority to which you wish to turn from among the locations listed above. The supervisory authority to which the complaint was submitted will then inform you of the status and results of your complaint, including the possibility of a judicial remedy pursuant to Article 78 of the GDPR. Prepared by: © DURY LEGAL Attorneys at Law – www.dury.de © Website-Check GmbH – www.website-check.de The Website-Check Seal. It indicates that the legal texts are up to date and links to a website with further information.