1. Controller / Data Protection Officer
1.1. Controller
The controller responsible for the data collection, processing and use is the operator of the website www.brinvestor.com:
Brinvestor GmbH
Daimlerstrasse 27
D-70825 Korntal-Münchingen
Tel.: +49 (0)711 5050150
Fax: +49 (0)711 50501515
E-Mail: info@brinvestor.com
Internet: www.brinvestor.com
The CEO Dipl. Kfm. Christian Benzing is authorized to represent our firm.
Commercial Register: Amtsgericht [Local Court] Stuttgart, HRB 720259
VAT ID: DE 814 623 312
(hereinafter: “BRINVESTOR” or “we”)
2. Basic Principles
We collect and process your personal data in compliance with the relevant provisions of statute, in particular the General Data Protection Regulation (hereinafter: “GDPR”) and the German Federal Data Protection Act (hereinafter: “BDSG”) and in accordance with the provisions below.
3. Definitions
Personal data means any information relating to an identified or identifiable natural person. This includes, for example, name, address, telephone number, e-mail address, IP address, user name, password, and information on the websites which are being viewed by a visitor.
3.2. Data subject
The data subject is any identified or identifiable natural person whose personal data are processed by the controller responsible for the processing or by the controller’s processor.
3.3. Processing
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. This includes collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
3.4. Restriction of processing
Restriction of processing means the marking of stored personal data with the aim of limiting the processing thereof in the future.
3.5. Controller
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
3.6. Processor
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
3.7. Recipient
Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.
3.8. Third party
Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
3.9. Consent
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
4. Collection, processing and use of your personal data
4.1. Log files
Every time our website is accessed, specific usage data are transmitted by the respective Internet browser and stored in log files, so-called server log files. This applies to the following data:
- Time and date when you accessed our website
- IP address of the accessing computer
- Name and URL of the file retrieved
- Volume of data transmitted
- Notification of whether the retrieval was successful
- Identification data of the browser and operating system used
- Website which the access came from
- Name of your Internet access provider
These data are collected and processed for the purpose of enabling you to use our website (setting up the connection), guaranteeing system security, technical administration of the network infrastructure, providing information to law enforcement authorities in the event of a cyber-attack or misuse and for optimizing our Internet presence.
These data will be erased when you leave our website – subject to any statutory or official retention obligations.
The legal basis for the collection, storage and use of these data is our legitimate interest in providing you with the information on our website without any impairment and in guaranteeing the necessary security (point f) of Art. 6 (1) sentence 1 GDPR).
4.2. Contact
If you contact us via e-mail, we collect, store and process your e-mail address, your name and the content of your communication. If you provide your postal address and additional contact data, then we also store and process these data.
If you contact us via contact form on our website we collect, store and process your e-mail address, your name and the content of your communication. These attributes are mandatory in order to be able to relate and to answer your inquiry by using the correct form of your address. If you wish us contacting you even by phone you can provide us with your phone number additionally. This information is voluntary.
Please note that in order to answer your communications we do not need to have these additional data you provide us with on a voluntary basis and please consider carefully whether you wish to disclose these data to us.
We store and use your personal data for the purpose of answering your questions and/or processing your messages or other subsequent queries or communications and relating your questions properly.
These data will be erased once the communications with you have been concluded – subject to any statutory or official retention obligations or if processing the data is lawful based on a different legal ground. This is performed at the latest after we have had no further communications with you for a period of one year.
The legal basis for processing your personal data is our legitimate interest in being able to communicate with you to respond to your communications (point f) of Art. 6 (1) sentence 1 GDPR) and your consent (point a) of Art. 6 (1) sentence 1 GDPR). Please note the explanations we have provided in section 7 below regarding withdrawal of this consent.
4.3. Real Estate Offers / E-mail advertising
You have the possibility of obtaining our free real estate offers and further information on our firm by e-mail.
We apply the so-called double opt-in process to enable us to send you this information by e-mail and to use the correct form of address for you. If you have provided us with your e-mail address for the purpose of transmitting offers and information described above, we will contact you by e-mail. After giving your consent to subscribing to our real estate offers and information on our firm by clicking on the button “consent” in our e-mail, you agree to our sending you information on our offers by e-mail to the e-mail address you provided, with a link containing respective explanations. Once you have activated the link by clicking on it after receipt of the e-mail, we have the right to send you our offers and also the information described. Your consent and your e-mail-address are thus verified again by means of the second act (clicking on the link).
For this purpose, notably to send you the personally-addressed offers and information on our firm, we will store and process your e-mail address. If you have already registered, then you have given us the following declaration of consent which we reiterate here for your information:
I agree to obtaining real estate offers and information from BRINVESTOR GmbH or/and advertising and promotion of BRINVESTOR GmbH via e-mail.
You can withdraw this consent to the use of your personal data at any time. It suffices for you to send us a communication to our Data Protection Officer in text form (by e-mail, letter, telefax). If you send it by electronic transmission or telefax, then no transmission costs are incurred apart from those of your standard tariff.
The legal basis for the processing of your data is your consent (point a) of Art. 6 (1) sentence 1 GDPR).
4.4. Processing on commission/Transferring data
4.4.1. Processing
Notwithstanding the other provisions, we reserve the right to transmit your data to processors acting on our behalf on the basis of the legal grounds set out above (e.g. in connection with IT support, hosting and data destruction). We always have agreements on data processing on commission with the service providers thus engaged. Such agreements ensure that the data transferred are only used by the processors acting on our behalf to perform tasks stipulated by us in accordance with the above purpose and in compliance with the technical and organizational measures necessary for data security and data protection.
4.4.2. Transferring data to third parties
Otherwise your personal data are not transferred to third parties for any purposes other than those set forth hereinbelow. We only transfer your personal data to third parties if:
- you have explicitly given your consent to this in accordance with point a) of Art. 6 (1) sentence 1 GDPR;
- the transfer is necessary pursuant to point f) of Art. 6 (1) sentence 1 GDPR for the establishment, exercise and defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being transferred;
- in the event that the transfer is subject to a legal obligation pursuant to point c) of Art. 6 (1) sentence 1 GDPR or
- processing is lawful and is necessary for handling contractual relationships with you pursuant to point b) of Art. 6 (1) sentence 1 GDPR.
5. Encryption/data security
5.1. The collection, processing and use of your data via our website is solely undertaken after being encrypted by means of SSL encryption (so-called Secure Socket Layer) with the highest level of encryption. This is currently 256 bit encryption. If your browser does not support 256 bit encryption, then we apply 128 bit v 3 technology instead. SSL is used to encrypt the continuous flow of data between the server and a user’s browser on the Internet and to thus prevent “illicit interception and retrieval” – insofar as is technically possible. An SSL connection can be identified, among other things, by the fact that the URL in the address bar of your browser starts with “https://” and/or by a “padlock symbol” or “key symbol” (icon) in the status bar at the bottom of your web browser. By clicking on the icon, you can obtain further information on the encryption and/or on the SSL certificate used, depending on which browser you use.
5.2. We only communicate by e-mail using the following encryption techniques …
5.3. Moreover, we use all reasonable, suitable, technical and organizational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss or destruction and against unauthorized access by third parties. Our security measures are continually improved and further evolved in accordance with technological development.
6. Erasure of the data/restriction of data processing
In principle, your data will be erased if your consent has lapsed or if the data are no longer required for the purpose of the data processing and if there is no longer a legitimate interest in further storage and processing. If these data have to continue to be stored thereafter, however, due to existing statutory, official or contractual obligations (e.g. warranty, financial accounting), the data processing will be restricted by means of marking these data and making them unavailable.
7. Rights of the data subject
As the person affected by the data processing (data subject) you have the following rights:
• Right of access (Art. 15 GDPR)
You have the right to obtain from us information on the personal data stored on you. This encompasses, in particular, information on the purposes of the processing, the categories of the processed personal data, the categories of recipients to whom your personal data have been or will be disclosed, the storage period, the existence of a right to rectification, or erasure or restriction of processing or to object to such processing, the existence of the right to lodge a complaint, where the data are not collected from you, information as to their source, and on the existence of automated decision-making, including profiling and, if applicable, meaningful information on the details thereof. Further, you have the right to receive a copy of your personal data undergoing processing by us.
• Right to rectification (Art. 16 GDPR)
You have the right to obtain from us without undue delay the rectification of inaccurate personal data and the right to have incomplete personal data completed.
• Right to erasure “Right to be forgotten” (Art. 17 GDPR)
You have the right to obtain from us the erasure of your personal data subject to the statutory requirements. If the erasure is opposed by statutory or official retention obligations or to the extent that the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims, the processing of the data shall be restricted (see below).
• Right to restriction of processing (Art. 18 GDPR)
You have the right to obtain from us, subject to the statutory requirements, the restriction of the processing of your personal data, i.e. by marking the personal data and restricting the future processing thereof (blocking).
• Right to data portability (Art. 20 GDPR)
You have the right to require of us, subject to the statutory requirements, that the personal data you provided be transmitted in a structured, commonly used and machine-readable format to you or to a controller named by you.
• Right to object to direct marketing (Art. 21 GDPR)
You have the right to object at any time to the processing of your personal data for advertising purposes (“objection to advertising”).
• Right to object to data processing in the event of the legal ground of “legitimate interest” (Art. 21 GDPR)
You have the right to object at any time to the processing of your data by us if this is based on the legal ground of “legitimate interest”. We will then discontinue processing the data unless we can demonstrate – in accordance with the statutory requirements – compelling legitimate grounds for the continued processing which override your interests.
• Right to withdraw consent (Art. 7 (3) GDPR)
If you have given us your consent to the collection and processing of your data, you have the right to withdraw this consent at any time with effect for the future. The withdrawal of consent shall not affect the lawfulness of the processing of your data based on consent before its withdrawal. Please note that, if applicable, we can, despite your withdrawal of consent, continue to collect and process your data if this is permitted and necessary on the basis of another legal ground (e.g. to perform a contractual relationship which may exist with you, due to a legitimate interest or due to a legal obligation).
• Right to lodge a complaint with the supervisory authority (Art. 77 GDPR)
You have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your personal data infringes applicable law. In this respect you have the possibility of lodging a complaint with the data protection authority responsible at your habitual residence or in your country, or with the data protection authority with responsibility for us.
8. Current Data Protection Statement, changes to it
This Data Protection Statement is up-to-date at the current time and is valid as per July 2018.
It can become necessary to modify this Data Protection Statement as a consequence of further developments of our website and offers or due to a change in statutory or official requirements.
The Data Protection Statement currently valid can be retrieved, stored and printed out from our website at: http://www.brinvestor.com/PRIVACY-STATEMENT/.
9. Supervisory authority responsible
The supervisory authority responsible for our law firm is:
The State Officer for Data Protection and Freedom of Information of the German State of Baden-Württemberg
Königstrasse 10a
70173 Stuttgart, Germany
Tel: +49 (0)711 615541-0
Fax: +49 (0)711 615541-15
E-mail: poststelle@lfdi.bwl.de
Version: July 2018