Data Protection

Privacy policy for website users and other forms of contact

Status: April 2024

 

1. Introduction

The protection of your personal data is very important to us, BUWOG Group GmbH, Austria, (hereinafter "BUWOG"). We therefore only process personal data in accordance with the applicable legal provisions for the protection of personal data, in particular the General Data Protection Regulation (GDPR). The following data protection information provides you with an overview of the processing of your personal data by us and your rights under data protection law. This data protection information explains whether and - if so - which personal data BUWOG processes and to what extent in connection with the processes listed below. As we continue to develop our website and integrate new technologies to improve our service to you, changes may be made to this privacy statement. We therefore recommend that you read this information again from time to time.
 

2. Contents

1. Introduction
2. Contents
3. Explanation of terms
4. Who is responsible for data processing and who can I contact?
5. Who does this privacy policy apply to?
6. What sources and data does BUWOG process from you?
7. What does BUWOG use your data for (purpose of processing) – and on what legal basis?
7.1 On the basis of your consent (Art. 6 para. 1 lit. a) GDPR)
7.2 For the performance of contractual or pre-contractual obligations (Art. 6 para. 1 lit. b) GDPR) 
7.3 On the basis of a legitimate interest (Art. 6 para. 1 lit. f) GDPR)
7.4 Due to legal requirements (Art. 6 para. 1 lit. c) GDPR)
8. Who receives your data?
9. Is data transferred to a third country or to an international organization?
10. Use of cookies and comparable data processing of end device information and personal data 
11. Social media plugins
12. Data security
13. How long is my data stored?
14. What data protection rights do I have?
15. Effect of non-communication
16. No automated decision-making

 

3. Explanation of terms

A definition of the data protection terms used below can be found in Art. 4 GDPR. The full text of the GDPR is available on the internet at the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679

 

4. Who is responsible for data processing and whom may I contact?

Controller pursuant to Art. 4 No. 7 GDPR: 
BUWOG Group GmbH
Rathausstraße 1 
A-1010 Vienna

External Data Protection Officer (eDPO):

Sascha Jung, LL.M. LL.M., Attorney at Law
Jank Weiler Operenyi RAe GmbH | Deloitte Legal Hohenstaufengasse 9
A-1010 Vienna
 

BUWOG will be happy to assist you with all questions relating to data protection. You can reach us at

E-Mail BUWOG:    datenschutz@buwog.com
Phone BUWOG:    +43 (1) 878 28 1000
E-Mail eDPO:         datenschutz-buwog@deloitte.at

 

5. Who does this privacy policy apply to?

Summarized, when we process personal data, this means that we collect, store, use, transfer or delete it. This data protection information relates to the personal data of

  • visitors to our website;
  • visitors to our website who use the communication options available on the website (e.g. contact forms) or make use of other of our services (e.g. our newsletter);
  • persons who contact us (e.g. by e-mail, fax, post or telephone)
  • Prospective real estate tenants and buyers

 

6. What sources and data does BUWOG process from you?

BUWOG processes your personal data when you contact us, e.g. as a visitor to our website, as a prospective tenant or buyer, when you write us a message or contact us in any other way, or as a subscriber to our newsletter. We process the following personal data:

  • Visit to our website

When you visit our website, we process the following data: technical access data, the name of your Internet service provider, the page from which you visit us or the name of the requested file, the date and time of your visit and the identification data of the browser/operating system used as well as your IP address. We evaluate this data - in anonymized form - for purely statistical and security-related purposes and without drawing conclusions about your person (e.g. to evaluate the number of page views, the duration of use, to defend against attacks on our server, etc.).

Further information regarding the use of cookies and tracking tools can be found in section 10 (Use of cookies/comparable data processing) and in the cookie banner at the beginning of your visit to our website (or available at any time under "Cookies" at the end of the website).

  • Communication - contact form

When using our contact forms (including for rental requests, reservations and other real estate inquiries) and subsequently for sending or providing the corresponding information, we process the data you provide in the respective form and your message.
Only the information marked accordingly (or not marked "optional") is mandatory. All other information is voluntary. Failure to provide voluntary data will of course not result in any disadvantages for you. In addition, your IP address and the date and time of the message will be stored when you send your message.

  • Communication - newsletter

When you use our form to order our newsletter or the BUWOG blog (insofar as we refer to newsletters in this data protection information, the BUWOG blog is always included) and subsequently for sending, we process the data you provide in the respective form.
In addition, your IP address and the date and time of the order are retained at the time of order placement.

We use the so-called double opt-in procedure for registration. This means that we will first send you an e-mail to the specified e-mail address after you have registered. In this e-mail, we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your data will be blocked by us and automatically deleted after one month. The purpose of this procedure is to be able to prove your registration and, if necessary, to prevent and clarify any possible misuse of your personal data.

  • Communication - other

If you contact us, for example by telephone, e-mail, fax or post, the content of your inquiry or the transmitted message text and the additional information transmitted, such as name, (e-mail) address and date sent, will be processed for the purpose of responding to your inquiry.

  • Form for a rental application or prospective interest

On our website we provide you with a prospective tenant form to download (PDF). The data you provide (e.g. first name, surname, address) will be processed in our internal administration program for prospective tenants. Further information will only be obtained from you or a third party at a later stage, whereby we will only obtain information on your financial circumstances (e.g. from KSV 1870) if the conclusion of a rental agreement with you depends solely on the positive result of such a credit check.

  • Job-Portal

As part of your online profile creation and online application, registration for the BUWOG job newsletter and joining the talent pool on the BUWOG career portal, we process the data you provide to us there. You can find more information on this in the special data protection provisions for the BUWOG online job portal, available at https://www.buwog.at/de/datenschutz.
 

7. What does BUWOG use your data for (purpose of processing) – and on what legal basis?

BUWOG is active in Austria and Germany. We therefore process the aforementioned personal data in accordance with the provisions of the GDPR, the Austrian Data Protection Act (DSG) and the German Federal Data Protection Act (BDSG). In detail:

7.1 Based on your consent (Art. 6 para. 1 lit. a) GDPR)

Data processing is legally permissible if you have consented to such processing for one or more specific purposes. You have the right to withdraw this consent at any time without affecting the legal basis of the processing carried out based on the consent until your withdrawal. Withdrawal of your consent also applies to declarations of consent given to BUWOG before the GDPR came into force, i.e. before May 25, 2018. Please note that the withdrawal is only effective for the future.

  • Visit to our website

The legal basis for the processing of the data mentioned in section 6 (visit to our website) by non- essential cookies/comparable data processing (see section 10) is your voluntary consent by selecting the respective categories and confirming them ("Allow all cookies" or "Accept selection") via the cookie banner when accessing the website.
We use your data and the data from cookies/comparable data processing to enable you to use all the features of our website, to design and optimize our website to meet your needs, to ensure security, and for tracking and marketing purposes (see in particular section 10).
 

  • Newsletter

Your consent is the legal basis for sending you the newsletter with which we inform you about our current interesting information about the Austrian BUWOG Group (i.e. BUWOG Holding GmbH, FN 212163 f, and all its affiliated companies in which it directly or indirectly holds an interest of at least 90%). You can subscribe to the BUWOG blog at www.buwog.com alternatively or cumulatively for the "Living" and "Career" sections (insofar as we refer to newsletters in this data protection notice, the BUWOG blog is always included)

We use your data to send the newsletter.
 

Withdrawal of consent(s)

You can revoke your consent(s) at any time for the future.

The withdrawal can be made informally, e.g. by e-mail to datenschutz@buwog.com (for newsletters to newsletter@buwog.com) or by sending a message to the contact details given above under section 4. You can declare the withdrawal of your subscription to the newsletter by clicking on the link provided in a newsletter email.

7.2 For the performance of contractual or pre-contractual obligations (Art. 6 para. 1 lit. b) GDPR)

We process your data to perform contractual or pre-contractual obligations:

  • Prospective tenant form

The legal basis for the processing of your data is Art. 6 para. 1 lit. b) GDPR (implementation of pre- contractual measures). The purpose of the processing is the preparation of a rental agreement between you and BUWOG or a company of the Austrian BUWOG Group.

  • Contact forms and other contact options

The legal basis for the processing of your data is Art. 6 para. 1 lit. b) GDPR (implementation of (pre)contractual measures) for the purpose of processing and responding to your inquiry and, if necessary, for the specific negotiation and preparation of a rental agreement and/or a real estate purchase agreement between you and BUWOG or a company of the Austrian BUWOG Group. In doing so, we use the communication channel specified by you (e.g. for sending information brochures).
 

7.3 On the basis of a legitimate interest (Art. 6 (1) lit. f of the GDPR)

We also process your data on the basis of our legitimate interests or those of third parties:

  • Visit to our website

The legal basis for the processing of the data referred to in section 6 (visit to our website) by means of necessary cookies/comparable data processing or by our website servers is our legitimate interest in the form of security and ensuring the technical functionality of our website.

  • Our messages in connection with your contact

In addition to the data that you actively transmit to us (e.g. e-mail address for the newsletter), BUWOG also processes personal data that is transmitted to us in the course of sending messages in connection with making contact (e.g. via our contact form, the newsletter or when applying for a property) (e.g. IP address, date and time). This data is processed to prevent misuse and to ensure the security of our information technology systems.

  • Settlement of legal disputes, assertion, exercise and defense of legal claims (e.g. in connection with rights and obligations under the GDPR).
  • Austrian BUWOG Group

To offer you the best possible service and remain competitive, we also exchange data within the Austrian BUWOG Group (i.e. BUWOG Holding GmbH, FN 212163 f, and all of its affiliated companies in which it holds a direct or indirect interest of at least 90%) for the purpose of managing and improving our services.

  • Marketing and direct marketing

We use your data for direct marketing purposes (e.g. to conduct customer surveys, opinion polls, marketing campaigns, market analyses, competitions, contests or similar promotions and events). In this context, we also analyze the results of (direct) marketing activities in order to measure the efficiency and relevance of our measures.

Right to object to the processing
According to Art. 21 para. 1 GDPR, you have the right to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6 para. 1 lit. f) GDPR (data processing to safeguard legitimate interests).

For more information on exercising this right, see below section 14.
 

7.4 Due to legal requirements (Art. 6 para. 1 lit. c) GDPR)

BUWOG processes personal data in order to comply with legal obligations under tax law as well as reporting and information obligations to authorities.

  • Compliance with legal requirements

Legal requirements are, for example, retention obligations under tax and commercial law, existing obligations to carry out monitoring measures to prevent white-collar crime or money laundering.
 

8. Who receives your data?

Within BUWOG, access to your data is only granted to those departments that require it to fulfill their tasks within BUWOG, to safeguard our legitimate interests or to fulfill contractual and legal obligations.

So that we can offer you the best possible service and remain competitive, we also exchange data within the Austrian BUWOG Group if this is necessary to safeguard our legitimate interests and your interests or fundamental rights and freedoms do not outweigh our interests. Whenever this is the case, we ensure that the transfer of data is carried out in accordance with data protection requirements and that your personal data is protected.

We also transfer your personal data to the following recipients for the following purposes:

  • External service providers

BUWOG uses the following external service providers to utilize their special expertise: (i) agents, (ii) property management companies, (iii) consultants, (iv) service providers, (v) marketing agencies, (vi) IT service providers and (vii) Vonovia SE (HRB 16879, Universitätsstraße 133, D-44803 Bochum).

Insofar as the aforementioned third parties are not themselves responsible for processing the transmitted data in accordance with Art. 4 No. 7 GDPR, they process your personal data on our behalf as so-called processors in accordance with Art. 28 GDPR. Processors only act on the instructions of BUWOG and are contractually obliged to comply with the applicable data protection requirements vis- à-vis BUWOG.

  • Public bodies

BUWOG transmits personal data to courts, supervisory authorities, tax authorities and other public bodies in exceptional cases due to legal regulations (e.g. in cases of averting danger or criminal prosecution).

 

9. Is data transferred to a third country or to an international organization?

Data will only be transferred to countries outside the EU or the EEA (so-called third countries) if this is necessary for the execution of your orders, is required by law (e.g. tax reporting obligations) or if you have given us your consent (e.g. cookies/comparable data processing, social media and tracking tools).

 

10. Use of cookies and comparable data processing of end device information and personal data

Cookies are small text files that store and/or read a wide range of information on the user's computer when they access our website. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall. Data processing of device information and personal data comparable to cookies can collect a wide variety of information when you visit our website and provide similar functions to cookies without actually using cookies. The cookies/comparable data processing used on our website are divided into the categories Necessary, Functions, Statistics, Marketing and Other. The categorization as well as a more detailed description of the respective cookies/comparable data processing was displayed to you when you accessed the BUWOG website. You can call up this cookie banner again at any time via the "Cookies" link at the bottom of the website.

Cookies/comparable data processing of the Necessary category are essential and required for the operation of the website. These cookies/comparable data processing operations are used to display the BUWOG website correctly and thus ensure user-friendly, effective and secure access. The legal basis for the processing of these cookies is the exemption provided for in the Austrian Telecommunications Act (TKG) pursuant to Section 174 TKG 2021 and our legitimate interest in this regard pursuant to Art. 6 para. 1 lit. f) GDPR.

All other cookies/comparable data processing of the categories marketing, statistics and/or preferences (together "non-necessary cookies/comparable data processing") are used to personalize content and ads, to recognize our website visitors, to offer functions for social media, to collect statistical information, to pursue marketing purposes with the help of web tracking tools and to be able to target offers more precisely. If you have consented to the use of "non-essential cookies/comparable data processing" on the BUWOG website via the cookie banner, these "non-essential cookies" will be stored on your computer or comparable data processing will be carried out on the basis of your consent. If you have not given your consent to the use of "non-essential cookies/comparable data processing" on the BUWOG website, no processing by non-essential cookies/comparable data processing will take place. If you wish to withdraw your consent, you can do so at any time by making the appropriate setting in the cookie banner, which you can access again via the "Cookies" link at the bottom of the website.

BUWOG uses different cookies/comparable data processing depending on the website visited. This website uses cookies/comparable data processing from the providers specified in the cookie banner when the website is accessed. Depending on which BUWOG website you visit, different cookie/comparable data processing categories (see previous paragraph) may be displayed.

 

11. Social media plugins

Social media plugins ("plugins") and the "share via" function of social networks are used on our website. We also use the map service Google Maps. These services are offered by the companies Facebook, WhatsApp, YouTube, X and Google ("providers").

  • Facebook

Facebook is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"). An overview of the Facebook plugins and their appearance can be found here: https://developers.facebook.com/docs/plugins.

  • WhatsApp

WhatsApp is operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("WhatsApp"). An overview of the WhatsApp plugins and their appearance can be found here: 
https://www.whatsapp.com/legal/.

  • X (formerly Twitter)

X is operated by Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 IRELAND ("X").

  • YouTube

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. An overview of the YouTube plugins and their appearance can be found here: 
https://developers.google.com/youtube/youtube_subscribe_button.

  • Google Maps

Google Maps is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Further information on embedding maps from Google Maps can be found here: 
https://support.google.com/maps/answer/144361?co=GENIE.Platform%3DDesktop&hl=en.

Content can be shared via Facebook, X and WhatsApp. Before you click on the corresponding button, no connection to the respective provider is established and no data is exchanged. The separate activation of these services is required to display videos or maps. By clicking on the respective button or activating the respective service, you consent to data processing in this regard. Your browser then establishes a direct connection to the servers of the respective provider. By integrating the plugins, the providers receive the information that your browser has accessed the corresponding page of our website, even if you do not have a profile or are not currently logged in. This information (including your IP address) is transmitted directly from your browser to a server of the respective provider and stored there. If you are logged in to one of the services, the providers can directly associate your visit to our website with your profile. This may also result in data (onward) transfers by the respective provider to third countries, such as the USA.

The purpose and scope of the data collection and the further processing and use of the data by these providers as well as your rights in this regard and setting options to protect your privacy can also be found in the providers' data protection notices:
 

The US Foreign Intelligence Surveillance Act (FISA) and other US laws stipulate that, among other things, US telecommunications companies and US internet service providers are obliged to provide information to the US authorities without a court order, making it possible to monitor users abroad (e.g. in the EU). In the USA, there is no effective protection of fundamental rights comparable to the European fundamental right to privacy. As US companies, Facebook, Google and YouTube are subject to these legal regulations.

 

12. Data security

The data transmitted to us by our customers is protected against external interference by our central system with firewalls etc. using state-of-the-art technology.

The transfer of data between the user and BUWOG always takes place using SSL/TSL encryption as soon as you use an input screen.

 

13. How long is my data stored? 

BUWOG processes and retains your personal data for as long as is necessary to achieve the purpose for which it was collected. If the data are no longer required to achieve the purpose for which they were collected, they will be deleted unless their - temporary - (further) processing is required for the following purposes:

  • Legal storage periods

To comply with the (commercial and tax) legal periods for storage and documentation from the Austrian Federal Fiscal Code (BAO) and the Austrian Commercial Code (UGB) as well as the German Commercial Code (HGB), the German Fiscal Code (AO): These periods are generally ten years.

  • Means of evidence

For the preservation of evidence within the statutory limitation periods:
According to the Austrian General Civil Code (ABGB) or Art. 195 ff. of the German Civil Code (BGB), these limitation periods can be up to thirty years, whereby the regular limitation period is three years.
 

The following also applies to storage with regard to individual processes:

  • Visit to our website

Your data will be deleted as soon as the respective session has ended. Log files are deleted after seven days. Storage beyond this period is possible in exceptional cases. In this case, however, the IP addresses of the users are deleted or anonymized so that it is no longer possible to identify the accessing client.
The storage period of cookie data is described in detail in the description of the individual cookies/comparable technologies in the cookie banner (available at any time under "Cookies" at the bottom of the website).

  • Contact forms and other communication

Data from the input masks of the contact forms or other means of communication will be deleted in cases of general communication when the respective conversation with you has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. If the communication with you results in a (potential) business relationship (e.g. a rental application) or other necessity, the data will be further processed for these purposes. Data relating to applications for a property and reservation requests will be deleted eight months after the property in question has been let or sold.
The additional personal data collected during the sending process (e.g. IP address) will be deleted after a period of seven days at the latest.

  • Newsletter

If you register for our newsletter as a visitor to our website, BUWOG uses the so-called double opt-in procedure. This means that BUWOG will send you an e-mail to the e-mail address you have provided after you have registered, in which BUWOG asks you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month.

We rely on your consent to the sending of a newsletter until you withdraw your consent. Once you have withdrawn your consent, your personal data will be deleted after a period of fourteen days at the latest. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The additional personal data collected during the sending process (e.g. IP address) will be deleted after a period of seven days at the latest.

 

14. What data protection rights do I have?

As a data subject of data processing, you have the following rights ("data subject rights") if the legal requirements under the GDPR are met:

  • Right to information:

In accordance with Art. 15 GDPR, you can request information from us as to whether BUWOG processes your personal data and which data this is.

  • Right to rectification:

If your data is incorrect, you can request a correction in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed. If BUWOG has passed on your data to third parties, these third parties will be informed of your correction - if this is required by law.

  • Right to erasure:

You have the right to have your data deleted by BUWOG if the requirements of Art. 17 GDPR are met (especially if the purposes for which your data was collected or processed no longer apply).

  • Right to restriction of processing:

You have the right to restrict the processing of your data if the requirements of Art. 18 GDPR are met.

  • Right to data portability

Furthermore, if you wish, we will make your data available to you for further use or transfer it to a recipient to be specified by you.

  • Right to withdraw consent (for more information on exercising this right, see above at section 7.1.):

If consent has been given to process personal data, there is the right to withdraw the consent given at any time with effect for the future, i.e. the withdrawal does not affect the lawfulness of the processing carried out before the withdrawal based on the consent. After withdrawal, BUWOG may only continue to process the personal data to the extent that processing is still necessary for BUWOG due to legal requirements.

  • Right to object to the processing:

According to Art. 21 para. 1 GDPR, you have the right to object at any time to the processing of personal data concerning you that is carried out based on Art. 6 para. 1 lit. f) GDPR (data processing to safeguard legitimate interests).

If you file an objection, we will no longer process your personal data for the purposes covered by the objection, unless

  • we can demonstrate compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or
  • the processing serves the assertion, exercise or defense of legal claims.
    If the objection is also or only directed against data processing for direct advertising, we will no longer process your personal data for this purpose.
    The objection can be made informally, e.g. by e-mail to datenschutz@buwog.com or by sending a message to the contact details given in section 4 above.
  • Right of complaint:

In addition, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR in connection with Section 24 DSG (for Austria) or Section 19 BDSG (for Germany)).

However, we recommend that you always address a complaint to our data protection officer first. You can find the contact details at section 4.
 

15. Consequences of non-providing of data

If the aforementioned personal data is not provided, BUWOG cannot collect it. It may not be possible to achieve the individual purposes described. For example, your application for a specific rental property cannot be considered.

 

16. No automated decision-making

BUWOG does not use fully automated decision-making within the meaning of Art. 22 GDPR to establish and implement contractual relationships.