Data protection

In this Privacy Policy, we inform you about how we handle your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). moovin GmbH (hereinafter referred to as “we” or “us”) is the data controller.

​

I. General Information

​

1. Contact

If you have any questions or suggestions regarding this information, or if you would like to contact us to exercise your rights, please direct your inquiry to

 

moovin Immobilien GmbH

Sternstraße 121, 20357 Hamburg

Phone: 040 – 22 61 630 50

Email: datenschutz@moovin.de

​

2. Legal Basis

 

The data protection term “personal data” refers to all information relating to an identified or identifiable individual. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. We process data only on the basis of a legal authorization. We process personal data only with your consent (Section 25(1) TDDDG or Article 6(1)(a) GDPR), to fulfill a contract to which you are a party, or at your request to take steps prior to entering into a contract (Article 6(1)(b) GDPR), to fulfill a legal obligation (Art. 6(1)(c) GDPR), or when processing is necessary to protect our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights and freedoms requiring the protection of personal data do not take precedence (Art. 6(1)(f) GDPR).

​

3. Retention Period

 

Unless otherwise specified in the following information, we retain the data only for as long as is necessary to achieve the purpose of processing or to fulfill our contractual or legal obligations. Such legal retention obligations may arise, in particular, from commercial or tax law provisions. Starting at the end of the calendar year in which the data was collected, we will retain personal data contained in our accounting records for ten years and personal data contained in business correspondence and contracts for six years. In addition, we will retain data related to consent requiring proof, as well as to complaints and claims, for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to its processing for this purpose.

​

4. Categories of Data Recipients

 

We engage data processors in connection with the processing of your data. The processing operations carried out by such data processors include, for example, hosting, maintenance, and support of IT systems; customer and order management; accounting and billing; marketing activities; and the destruction of files and data storage media. A data processor is a natural or legal person, public authority, agency, or other entity that processes personal data on behalf of the data controller. Data processors do not use the data for their own purposes but carry out data processing exclusively on behalf of the data controller and are contractually obligated to ensure appropriate technical and organizational measures for data protection. In addition, we may transfer your personal data to entities such as the owners or landlords of the targeted property, postal and delivery services, our primary bank, tax advisors/auditors, or the tax authorities. Additional recipients may be identified in the following notices.

​

5. Data Transfers to Third Countries

 

Visiting our website may involve the transfer of certain personal data to third countries—that is, countries where the GDPR is not applicable. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is ensured in that third country. If no such adequacy decision by the European Commission exists, the transfer of personal data to a third country will only take place if appropriate safeguards are in place pursuant to Article 46 of the GDPR or if one of the conditions set forth in Article 49 of the GDPR is met.

​

Unless otherwise specified below, we use the EU Standard Contractual Clauses for the transfer of personal data to processors in third countries as appropriate safeguards: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087.

 

If you consent to the transfer of personal data to third countries, the transfer is based on the legal basis of Article 49(1)(a) of the GDPR.

​

6. Processing in Connection with the Exercise of Your Rights

 

When you exercise your rights under Articles 15 through 22 of the GDPR, we process the personal data you provide for the purpose of implementing those rights and to be able to provide evidence thereof. We will process data stored for the purpose of providing information and preparing such information solely for this purpose and for data protection monitoring purposes, and will otherwise restrict processing in accordance with Article 18 of the GDPR.

 

This processing is based on the legal basis of Article 6(1)(c) of the GDPR in conjunction with Articles 15 through 22 of the GDPR and Section 34(2) of the BDSG.

 

7. Your Rights

 

As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:

​

• In accordance with Article 15 of the GDPR and Section 34 of the BDSG, you have the right to request information regarding whether we process personal data about you and, if so, to what extent.

• In accordance with Article 16 of the GDPR, you have the right to request that we correct your data.

• You have the right to request that we erase your personal data in accordance with Article 17 of the GDPR and Section 35 of the BDSG.

• You have the right to have the processing of your personal data restricted in accordance with Article 18 of the GDPR.

• You have the right, in accordance with Article 20 of the GDPR, to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format and to transmit this data to another controller.

• If you have given us separate consent to the processing of your data, you may revoke this consent at any time in accordance with Article 7(3) of the GDPR. Such revocation does not affect the lawfulness of the processing carried out on the basis of your consent prior to the revocation.

• If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR.

 

8. Right to Object

 

Pursuant to Article 21(1) of the GDPR, you have the right to object to processing based on Article 6(1)(e) or (f) of the GDPR on grounds relating to your particular situation. If we process your personal data for the purpose of direct marketing, you may object to such processing in accordance with Article 21(2) and (3) of the GDPR.

​

9. Data Protection Officer

 

You can contact our Data Protection Officer using the following contact information:

​

Email: dsb@moovin.de

Herting Oberbeck Datenschutz GmbH

Hallerstr. 76, 20146 Hamburg

https://www.datenschutzkanzlei.de

​

II. Data Processing on Our Website

​

When you use the website, we collect information that you provide yourself. In addition, during your visit to the website, we automatically collect certain information about your use of the website. Under data protection law, an IP address is generally considered personal data. An IP address is assigned to every device connected to the Internet by the Internet service provider so that it can send and receive data.

​

1. Hosting and Processing of Server Log Files

 

When you use our website for informational purposes only, general information that your browser transmits to our server is initially stored automatically (i.e., without registration). By default, this includes: browser type and version, operating system used, page accessed, the previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code. This processing is carried out to safeguard our legitimate interests and is based on the legal basis of Article 6(1)(f) of the GDPR. This processing serves the purposes of technical administration and website security. The stored data is deleted after seven (7) days, unless there are concrete indications giving rise to a legitimate suspicion of unlawful use, in which case further review and processing of the information is necessary for this reason. We are unable to identify you as a data subject based on the stored information. Articles 15 through 22 of the GDPR therefore do not apply pursuant to Article 11(2) of the GDPR, unless you provide additional information that enables your identification in order to exercise your rights set forth in these articles.

 

Our website is hosted using services provided by Wix.com Ltd. (Israel). This includes the use of content delivery networks to efficiently display fonts, images, and other content. This is carried out on the legal basis of Article 6(1)(f) of the GDPR and serves our legitimate interest in the cost-effective and user-friendly operation of the website. The European Commission has issued an adequacy decision (2011/61/EU) for the State of Israel, ensuring an adequate level of data protection in accordance with Article 45 of the GDPR.

​

2. Sentry

 

Our website uses the Sentry service provided by Functional Software Inc. (USA). Sentry is used to monitor system stability and identify code errors in order to improve the website. Information regarding the device or the time of the error is collected in pseudonymized form and subsequently deleted. This data is not analyzed for advertising purposes. Further information on Sentry’s privacy policy can be found on the following website: https://sentry.io/privacy/. The legal basis for data processing in connection with the use of this service is Article 6(1)(f) of the GDPR, and the processing serves our legitimate interest in optimizing our website.

​

With Sentry, the transfer of data to the United States cannot be ruled out. Please refer to the information in the section “Data Transfer to Third Countries.”

​

3. Use of the moovin Software

 

a. Tenant Account

 

You have the option to register with us as a prospective tenant or buyer of real estate properties. Through your tenant or buyer account, you can then, for example, view real estate listings and apply for rental or purchase properties. The data collected during registration includes your email address, first and last name, phone number, and a password of your choice. You may also provide additional voluntary information. You can manage your data in your personal account area.

​

If you wish to use electronic payment methods via the moovin software, you will be redirected to the respective provider’s website. Please refer to the privacy policy of the relevant provider.

​

The data processing described is necessary to provide the contractually agreed services and is carried out on the legal basis of Article 6(1)(b) of the GDPR.

​

b. Credit Check

 

If we make an advance payment—for example, in the case of a purchase on account—we may, to protect our legitimate interests, obtain a credit report based on mathematical and statistical methods from the Verband der Vereine Creditreform e.V., Hellersbergstraße 12, 41460 Neuss. To this end, we transmit the personal data required for a credit check to Creditreform e.V. and use the information received regarding the statistical probability of default to make a balanced decision regarding the establishment, execution, or termination of the contractual relationship. Credit reports may contain probability values (scores) that are calculated using scientifically recognized mathematical and statistical methods and incorporate address data into their calculation. Your legitimate interests are taken into account in accordance with legal provisions. The legal basis is Article 6(1)(f) of the GDPR.

​

c. Transactional Emails

 

To send automatically generated emails (e.g., confirmation of viewing appointments), we use the MailChimp service provided by The Rocket Science Group LLC d/b/a MailChimp (USA). We therefore transmit your email address to MailChimp. The MailChimp service offers statistical analysis options for usage data.

​

This includes, among other things, information on whether an email reached the recipient or was rejected by the server.

​

This processing is carried out on our behalf and is based on the legal basis of Article 6(f) of the GDPR. It serves our legitimate interest in the cost-effective sending and tracking of our contract-related notifications.

 

d. Use of the Email Address for Marketing Purposes

 

We may use the email address you provided during registration to inform you about similar products and services we offer. The legal basis is Article 6(1)(f) of the GDPR in conjunction with Section 7(3) of the German Unfair Competition Act (UWG). You may object to this at any time without incurring any costs other than the transmission costs according to the standard rates. To do so, you can unsubscribe by clicking the unsubscribe link included in every email or by sending an email to hello@moovin.de.

​

For such customer communications, we use the Zoho Campaigns service provided by Zoho Corporation (USA). Your email address may therefore be transmitted by us to Zoho. This processing is carried out on our behalf and is based on the legal basis of Article 6(f) of the GDPR. It serves our legitimate interest in the cost-effective distribution of such customer communications.

​

The service offers statistical analysis options for usage data. We also analyze reading behavior and open rates for our newsletter. To this end, we collect and process pseudonymized usage data, which we do not link to your email address or IP address. The legal basis for analyzing our newsletter is Article 6(1)(f) of the GDPR, and the processing serves our legitimate interest in optimizing our newsletter. You may object to this at any time by contacting us through one of the channels listed above.

 

When using Zoho Campaigns, the transfer of data to third countries cannot be ruled out. Please refer to the information in the section “Data Transfer to Third Countries.” For more information on data protection at Zoho Campaigns, please see the Zoho Campaigns Privacy Policy at https://www.zoho.com/de/privacy.html.

 

III. Data Processing on Our Social Media Pages

​

We maintain company pages on several social media platforms. Through these, we aim to provide additional opportunities to learn about our company and engage with us. Our company has pages on the following social media platforms:​​

​

• Facebook, operated by Meta Platforms Ireland Limited (Ireland, EU), hereinafter “Meta”;

• Instagram, operated by Meta Platforms Ireland Limited (Ireland, EU), hereinafter “Meta”;

• LinkedIn, operated by LinkedIn Ireland Unlimited Company (Ireland, EU), hereinafter “LinkedIn”;

• XING operated by NEW WORK SE (Germany, EU), hereinafter “XING.”

​

When you visit or interact with a profile on a social media platform, your personal data may be processed. The information associated with a social media profile you use also regularly constitutes personal data. This includes messages and statements made while using the profile. In addition, when you visit a social media profile, certain information about your visit is often automatically collected, which may also constitute personal data.

 

Visiting a Social Media Page

​​

When you visit our social media page, through which we present our company or individual

products from our range, certain information about you is processed.

The operators of the social media platforms are solely responsible for this processing of personal data. Further information regarding the processing of personal data can be found in their privacy policies, to which we provide links below:

​

• Meta (https://www.facebook.com/privacy/explanation). Meta offers the option to

object to certain data processing activities; information on this and opt-

out options can be found at https://www.facebook.com/settings?tab=ads;

• LinkedIn (https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-

privacy-policy)

• XING (https://privacy.xing.com/de/datenschutzerklaerung/druckversion)

 

The operators of these social media platforms collect and process event data and profile data and provide us with anonymized statistics and insights for our pages, which help us gain an understanding of the types of actions people take on our page (so-called “Page Insights”). These Page Insights are generated based on specific information about people who have visited our page. This processing of personal data is carried out by the social media operators and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions taken on our site and improving our site based on these insights. The legal basis for this processing is Article 6(1) (f) of the GDPR.

​

We cannot link the information obtained through Page Insights to individual user profiles that interact with our pages. We have entered into agreements with the operators of the social media platforms regarding processing as joint controllers, which define the allocation of data protection obligations between us and the operators. Details regarding the processing of personal data for the creation of Page Insights and the agreement concluded between us and the operators can be found at the following links:

​

- Meta (https://www.facebook.com/legal/terms/information_about_page_insights_data);

- LinkedIn (https://legal.linkedin.com/pages-joint-controller-addendum);

- XING (https://www.xing.com/terms/onlyfy-one#h2-vereinbarung-zur-gemeinsamen-

datenschutzrechtlichen-verantwortlichkeit).

​

You also have the option to exercise your rights with the operators. Further information on this can be found at the following links:

​

- Meta (https://www.facebook.com/privacy/explanation);

- LinkedIn (https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de);

- XING (https://privacy.xing.com/de/datenschutzerklaerung/welche-rechte-koennen-sie-

exercise-your-rights).

​

We have agreed with Meta and LinkedIn that the Irish Data Protection Commission is the lead supervisory authority responsible for overseeing the processing of Page Insights. You always have the right to file a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or with any other supervisory authority.

​

2. Communication via Social Media Pages

We also process information that you have provided to us via our company page on the

respective social media platform. Such information may include the

username you use, contact information, or a message sent to us. We carry out this processing

as the sole data controller. We process this data based on our

legitimate interest in contacting individuals who have submitted inquiries. The legal basis for the

data processing is Article 6(1)(f) of the GDPR. Further data processing may

take place if you have given your consent (Article 6(1)(a) of the GDPR) or if this is necessary to

comply with a legal obligation (Article 6(1)(c) of the GDPR).

​

IV. Further Data Processing

​

1. Contact via Email

 

If you send us a message via the contact email address provided, we will process the data you provide for the purpose of responding to your inquiry. If your inquiry relates to the conclusion or performance of a contract with us, the legal basis for data processing is Article 6(1)(b) of the GDPR. Otherwise, we process the data based on our legitimate interest in contacting individuals who submit inquiries. The legal basis for data processing in this case is Article 6(1)(f) of the GDPR.

​

2. Job Applications

 

If you apply for a position at our company, we process your application data exclusively for purposes related to your interest in current or future employment with us and the processing of your application. Your application will be processed and reviewed only by the relevant contact persons at our company. All employees entrusted with data processing are obligated to maintain the confidentiality of your data. If we are unable to offer you employment, we will retain the data you have provided for up to six months following any rejection in order to answer questions related to your application and the rejection. This does not apply if legal provisions preclude deletion, if further storage is necessary for evidentiary purposes, or if you have expressly consented to longer-term storage. The legal basis for data processing is Section 26(1), Sentence 1 of the German Federal Data Protection Act (BDSG). If we retain your applicant data beyond the six-month period and you have expressly consented to this, please note that this consent may be freely revoked at any time in accordance with Article 7(3) of the General Data Protection Regulation (GDPR). Such a revocation does not affect the lawfulness of the processing that took place on the basis of your consent prior to the revocation.