1. This data protection information applies to the processing of your personal data if you are/become a visitor to our website, interested party, tenant, subtenant or buyer, as well as in the context of our marketing measures. If you act as a legal entity in this sense, this data protection information will only be used to a limited extent (the GDPR only concerns data of natural persons). In certain circumstances you should inform your employees accordingly.

2. You can retrieve, save and print this data protection information from any Vonovia SE and Vonovia Kundenservice GmbH website at any time free of charge. Other websites (e.g. Vonovia Immobilien Treuhand GmbH) are not covered by this data protection information and provide their own specific data protection information.

The following are jointly responsible for the processing of your data

1. for prospective tenants: Vonovia Kundenservice GmbH and Vonovia SE as jointly responsible bodies.

2. for tenants, subtenants and potential buyers: Vonovia Kundenservice GmbH, Vonovia SE and the respective real estate holding, renting or selling company as so-called joint responsible bodies (if you are a tenant with us, please refer to your tenancy agreement).

3. Vonovia SE (Universitätsstraße 133, 44803 Bochum) and Vonovia Kundenservice GmbH (Am Silberpalais 1, 47057 Duisburg) are joint contact points for inquiries. Please direct your inquiries:

by telephone to: 0234 414 700-000
by fax to: 0234 314 888-4414
By e-mail to: service@vonovia.de

Please direct your questions about data protection to

Dr. Stefan Drewes
c/o Vonovia SE
Postfach
44784 Bochum
E-Mail: datenschutz@vonovia.de

We expressly point out that when using this e-mail address, the contents are not exclusively noted by only our data privacy officer. If you would like to exchange confidential information, please contact us directly via this e-mail address without giving us a detailed description of the facts.

This data protection information is based on the following terms, which we have defined for the sake of easier understanding:

1. The GDPR is the basic EU data protection regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC).

2. A recipient is a natural or legal person, authority, institution or other body to which personal data is disclosed, regardless of whether it is a third party or not. However, authorities which may receive personal data under Union law or the law of the Member States within the framework of a particular investigation mandate shall not be regarded as recipients; the processing of such data by the said authorities shall be carried out in accordance with the applicable data protection rules and in accordance with the purposes of the processing. Recipients may be banks in connection with the collection of rents or the post office through which we send you your rental contract documents.

3. The data controllers are two or more persons jointly responsible within the meaning of Clause 1.4.9. who jointly determine the purposes of and the means of processing personal data. Vonovia Kundenservice GmbH and Vonovia SE, for example, jointly determine the means and purposes for processing personal data of prospective tenants and are therefore jointly responsible.

4. You are a potential customer if, for example, you inform yourself on our websites about Vonovia and our offers and services, create an account in the online customer portal (accessible via mein.vonovia.de) and use its functions (e.g. storage of property favorites) and arrange viewing appointments with us.

5 You are a buyer from the moment you have countersigned the purchase contract for a property of Vonovia Immobiliengruppe with the notary.

6 You are the tenant from the moment you receive your rental contract countersigned by Vonovia Immobiliengruppe.

7. Personal data is all information relating to an identified or identifiable natural person. Identifiable is a natural person who can be identified directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier or one or more special characteristics that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person (Art. 4 No. 1 GDPR). Personal data can be name and contact data, user behavior or bank data.

8. You are a (future) subtenant if an existing tenant submits an application to us for subletting in which you are specified as a subtenant.

9. The data controller is the natural or legal person, authority, institution or other body that alone or together with others decides on the purposes and means of processing personal data. Where the purposes and means of such processing are laid down by Union law or by the law of the Member States, the controller or the specific criteria for his appointment may be laid down in accordance with Union law or the law of the Member States. Vonovia SE is responsible for processing the data described in this data protection declaration (see above Data controller within the meaning of Art. 4 No. 7 GDPR).

10. Processing includes the collection, recording, organization, arrangement, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of provision, comparison or linking, limitation, deletion or destruction of personal data (Art. 4 No. 2 GDPR). Processing may include the collection and use of your contact data to arrange a viewing appointment.
11. The Vonovia Real Estate Group includes all companies affiliated with Vonovia SE pursuant to § 15 of the German Stock Corporation Act (AktG).

If you call up our websites in order to obtain information about our real estate offers and services, without registering in the customer portal, without arranging a viewing appointment with us or without actively transmitting information to us in any other way (purely informational use), we also process personal data. Your personal data will be processed for the following purposes and on the basis of the following legal bases:

1. When you visit our website, we process your personal data, which is technically necessary for us to provide you with our website and to ensure the stability and security when you visit our website. We process the following personal data for this purpose:

IP address
Browser User Agents
Cookies (Section 2.1.3.)

2. We process your personal data on the basis of our legitimate interest in providing you with information on our products and services on our websites and to guarantee IT security for you when visiting our websites, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

1. When you visit our websites, we may monitor and document how you use our websites, e.g. your surfing habits on our websites and which properties you are interested in. We process the following personal data for this purpose:

IP address
UU-ID
WEB-ID
Cookies

2. We process your personal data on the basis of our legitimate interests in carrying out analyses and improving our website and our products and services on the basis of these analyses, as well as on the basis of our legitimate interest in fraud prevention, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

3. For this analysis, we use Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytics uses cookies that enable us to analyze the use of our website. The information generated by the cookie about the use of our website is generally transmitted to a Google server in the USA, where it is stored. If IP anonymization is activated on our websites, the IP address of the website visitor will, however, be truncated by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of Vonovia, Google will use this information for the purpose of evaluating website usage, compiling reports on website activity and providing Vonovia with other services relating to website activity and Internet usage.
The IP address transmitted by the user's browser as part of Google Analytics is not merged with other data from Google.
You may disable the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.
You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) and Google from processing this data by downloading and installing the browser plug-in available under the following link:

https://tools.google.com/dlpage/gaoptout?hl=de.

An Opt-Out-Cookie is set, which prevents the future collection of your data when visiting these websites.
Our websites use Google Analytics with the extension "_anonymizelp()". This means that IP addresses are shortened for further processing; direct personal references can thus be ruled out.
Google Analytics is used in accordance with the requirements on which the German data protection authorities have agreed with Google.
You can find further information on terms of use and data protection at:

https://www.google.de/intl/de/policies/terms/regional.html
https://www.google.de/intl/de/policies/privacy

In connection with the use of Google Analytics, your personal data will be transferred to the USA. In the case of the USA, the EU Commission has not decided that there is an adequate level of data protection within the meaning of the GDPR; there is no such adequacy decision (Art. 45 GDPR). However, Google LLC is subject to the EU-U.S. Privacy Shield. This ensures adequate protection of your personal information. The full text of the EU-U.S. Privacy Shield Framework can be viewed at the following link:

https://www.privacyshield.gov/servlet/servlet.FileDownload?file=015t00000004qAg

1. When you use our website, cookies are stored on your computer. Cookies are small text files that are assigned to and stored on your hard drive by the browser you are using and through which certain information flows to the location that sets the cookie. These also contain personal data. Cookies cannot run programs or transmit viruses to your computer. They serve to make the Internet offer more user-friendly and effective overall.

2. The cookie information of Vonovia SE and the companies affiliated with Vonovia SE pursuant to § 15 AktG (German Stock Corporation Act) applies to the use of our websites (available at www.vonovia.de/cookie-richtlinien).

1. You can register on our website in our online customer portal. Via our online customer portal, we offer you various services within the framework of your property search and your tenancy. The registration and use of our online customer portal requires the entry of personal data. Mandatory fields are marked accordingly in the input mask. We use the so-called "double opt-in procedure" for registration. As soon as you have filled in the input mask, you will receive an e-mail from us with a link to your registration. Only after you click on this link and confirm your registration will your registration be complete.

2. We process your personal data in order to enable you to create and use your account in the online customer portal and, based on our legitimate interest, to inform you about our real estate offers and services and to provide you with special functions (such as calling up favorites at the next login). This data is processed on the basis of Art. 6 Para. 1 S. 1 lit. b) and lit. f) GDPR If you provide voluntary information during registration, you consent to the processing of this data by us. The processing of your voluntary data takes place on the basis of your consent within the meaning of Art. 6 Para. 1 S. 1 lit. a) GDPR.

3. For the use of the tenant advantages a registration is necessary in advance in the customer portal with the data marked there as obligation fields. Only when this data has been stored does the user have access to our customer advantage page. For existing customers or extended prospective customers, this data is already maintained in the profile, which means that after logging in to the customer portal, these users can directly view the page of special offers in the customer portal and then access the external website of MIVO mitarbeitervorteile GmbH via the teaser or the link (kundenvorteile.de). The data is automatically transmitted to the external website. After the transfer, MIVO mitarbeitervorteile GmbH alone is responsible for the processing of your personal data; their data protection regulations apply.

4. We would like to point out that, within the framework of the tenant's right to inspect receipts, invoices can be entered into the customer portal which serve as the basis for the respective incidental expenses statement. Further information on this can be found under "Execution of the rental agreement".

1. Once you have registered, you can view, change and supplement your data in the online customer portal under "My Profile". Required information is marked accordingly. Furthermore, you can provide further, voluntary information.

2. The processing of the required data serves the provision of our online customer portal and, if necessary, also the initiation, preparation, execution and processing of your contract and / or other services of Vonovia or the Vonovia Real Estate Group. The processing and storage of your personal data takes place on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR. If you voluntarily provide information, you consent to the processing of this data by us. The processing of your voluntary data takes place on the basis of your consent within the meaning of Art. 6 Para. 1 S. 1 lit. a) GDPR.

We carry out marketing measures within the framework of the brokerage of our real estate. If you are interested in our properties, you can subscribe to our information e-mails. These e-mails will inform you about real estate properties and services of Vonovia Immobiliengruppe. We process your personal data if you give us your consent to do so within the meaning of Art. 6 Para. 1 S. 1 lit. a) GDPR.

1. If you are interested in our properties, you can arrange viewing appointments with us. You can contact us by phone, WhatsApp, our chatbot on our website, in writing, via the online customer portal or via our website using the property search function, and make a viewing request. We process your personal data in order to arrange a viewing appointment with you, and to prepare and carry out this on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

2. The use of WhatsApp is subject to the data protection information of the messenger service or social network you are using. Please refer to the corresponding data protection information for further details:

https://www.whatsapp.com/legal/#privacy-policy

If an existing tenant terminates his tenancy agreement with us, he may have the opportunity to advertise the property to you as a potential future tenant. If a tenancy agreement is concluded between you and us, we will pay a premium to the existing tenant, subject to certain conditions. You can complete a form ("Tenants recruit tenants") together with the existing tenant. We process your personal data as a prospective tenant for the purposes of initiating a rental agreement with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR. In this context, we process personal data of existing tenants who advertise on the basis of our legitimate interest in carrying out marketing measures and finding suitable new tenants for our properties on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

So-called occupancy beneficiaries (i.e. those who have made a significant contribution to the financing of a building) can propose or name potential tenants (allocated) for real estate with occupancy rights. Subsequently, inspections are carried out with these and all other prospective tenants. We process your personal data for the initiation and, if necessary, for the conclusion of your rental agreement with us on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR. The person entitled to occupancy will be informed of the first and last name of the current tenant or new tenant as well as the address of the building in question within the framework of the new letting and termination. This applies both to tenants who have been assigned or named by the person entitled to occupancy as well as to all other tenants of an exempt occupancy housing ("third-party tenants"). The data transfer is based on the existence of a legitimate interest on the part of Vonovia, Art. 6 Para. 1 S. 1 lit. f GDPR.

1. If one of our properties appeals to you at a viewing appointment, you can reserve it. We will draw up a reservation protocol and ask you to submit all the documents required to conclude the rental agreement with us. We process your personal data in order to reserve the property for you and to prepare the rental agreement with you and to create it with us on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

2. Once you have signed your reservation protocol, we will carry out a credit check. The credit check is carried out by a credit rating service provider (such as infoscore Consumer Data GmbH or Creditreform e.V.). Your creditworthiness is assessed on the basis of mathematical-statistical procedures, so-called scoring. For this purpose, your personal data, which are required for the credit assessment, are transmitted to the credit service provider. We process your personal data for the purpose of credit assessment in order to avoid payment default. On the basis of the transmitted personal data, including the address data, a statistical probability for a credit default and thus your solvency is calculated. The credit rating service provider then transmits your score value to us. In addition, we may also use the services of address determination companies to check your address as part of the credit check. This personal data will be processed on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR in order to implement your contract with us and on the basis of our justified interest in avoiding a default of payment on your part on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR. If the credit check is positive, we can offer you the property that you have reserved; if it is negative, we can check separately and manually if the reserved property can be offered to you. However, if we cannot offer you the property, you can still apply for other Vonovia properties. The scope of scoring is limited to whether payment obligations can be met for the specific property reserved. We use scoring exclusively to protect ourselves against possible payment defaults.

With our countersignature of your rental contract you are an existing tenant. Your rental agreement and attachments have been created with us. If you have registered in our customer portal, you can view and download these documents there. As part of the execution of your rental agreement (e.g. payment of your rent and ancillary costs under the rental agreement), we process your personal data for the purpose of executing and processing your rental agreement on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

The tenant has the right to inspect receipts and in this context may also request access to the individual consumption data of other users of the relevant billing unit. Therefore, the invoices which serve as the basis for the respective service charge statement can be viewed in the customer portal. Access to these receipts and thus to the personal data contained therein is always only granted to the tenants who share the respective costs. Here the names of the tenants of the billing unit concerned as well as the respective consumption data can be contained.

You can provide us with a SEPA direct debit mandate (Single Euro Payment Area) to settle your rent and ancillary costs (such as heating costs) under the rental agreement and authorize us to collect these payments. You can also grant us this authorization via the online customer portal under "My rental contracts/ payment options" by making the appropriate settings. In connection with the heating bill, we also prepare a consumption analysis. We process your personal data in order to carry out the rental agreement with you and process the payment obligations arising in this connection with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

We are legally obliged to perform a rental price check. We process personal data of our tenants. The processing of your personal data is carried out on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR in order to check whether the rent has been collected in accordance with the law and whether the respective property is occupied in accordance with the legal requirements.

1. If you conclude a rental agreement with us and move into your apartment afterwards, we are legally obliged (e.g. § 19 Federal Registration Act) to confirm your move in to the registration authority. For this purpose, we will issue you a certificate of residence for you to present to the registration authority. In doing so, we process your personal data.

2. Some of our properties are financed with public funds. If you wish to rent one of these properties, you must prove your entitlement by means of a residence entitlement certificate. If you apply for and receive a residence entitlement certificate from the relevant housing office, it will be forwarded to us. We then fill it out, countersign it and send it back to the responsible housing office (§ 4 Abs. 6 Wohnungsbindungsgesetz).

3. In order to fulfil our legal obligations, we process your personal data on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR.

In the case of publicly subsidized housing, the funding provider may request personal data from us. If there is a legal basis, the personal data will be passed on to the funding provider for the legally regulated purposes.

1. As an existing tenant, you can access the online customer portal under "My rental contracts/repairs and inquiries", via WhatsApp, via our chatbot on our website or via our service number (tel: 0234 414 700-000) Reporting repairs. In the event of damage to the rental property, we will handle the case in order to carry out appropriate repair measures and report the incident to our insurance companies.

2. We process your personal data to implement the rental contract with you on the basis of Art. 6 Para. 1 S. 1 lit.. b) GDPR, due to our legal obligation to maintain the rental property (§ 535 para. 1 German Civil Code) on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR and due to our legitimate interest to maintain and modernize our real estate properties and to process claims through our insurance companies, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

1. In the event of damage, we process your personal data for the processing and administration of insurance (such as building insurance, property insurance). The data is processed for the purpose of implementing the rental agreement on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR and on the basis of our legitimate interest in asserting and / or enforcing legal claims on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

2. If a claim is processed via our liability insurance, you will receive a notification form from us. In this form, you will enter, among other things, information about the damage. The notification form will then be sent to our insurer. Your personal data will be processed in order to execute the rental agreement with you, on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

If you have a modernization request, you can approach Vonovia and receive an offer from us if necessary. We process your personal data when you contact us, prepare an offer and carry out the modernization. Processing is carried out to implement the rental agreement with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR and on the basis of our legitimate interest in being able to offer our tenants modernizations on request on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

For certain construction measures on / in your property, you can apply for building cost subsidies from your nursing care fund. If you entitle us to do so by means of a declaration of assignment, we will apply to your nursing care insurance fund for a subsidy on your behalf when the construction work is carried out. They will then transfer the subsidy directly to us. We process your personal data on the basis of your declaration of assignment, with which you authorized us to apply for the subsidy from the nursing care insurance fund, on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

1. If you are a tenant and would like to sublet your property, you can submit an appropriate application to us. We process your personal data and the personal data of the (future) subtenant on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR in order to process your application and, on the basis of our legitimate interest in being able to identify the potential subtenant within the framework of our consent to subletting, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

2. In individual cases (such as water damage or repairs), it may be necessary for us and any craftsmen commissioned by us to have access to the property. We will contact you if necessary and ask you to provide us with the contact details of your subtenant. We process your personal data and the data of your subtenant in order to fulfil our obligations from the tenancy and to maintain the apartment on the basis of Art. 6 Para. 1 S. 1 lit. b) and c) GDPR.

3. In the event that you provide personal data of your (future) subtenant, you shall ensure that the subtenant has been sufficiently informed by you about the processing of his data by Vonovia and that you are entitled to provide such data.

4. In all other respects, the provisions of this data protection information shall apply mutatis mutandis to subtenants insofar as they relate to tenants.

1. If you have any questions about Vonovia, our properties or services, require assistance in finding properties, would like to arrange viewing appointments or, as a tenant, have any questions about your rental agreement, you can contact our customer service. You may contact us by telephone, WhatsApp, our chat bot on our website, in writing or via the online customer portal. We process your personal data based on the nature of your request. If necessary, we may also use personal data stored in our systems as part of other data processing (e.g. data that you provided when arranging a viewing appointment with us or concluding a rental agreement with us).

2. Depending on your request, your personal data will be processed for the purpose of initiating, implementing or, if necessary, processing the contract with you on the basis of Art. 6 Para. 1 S.1 lit. b) GDPR, in order to fulfill our legal obligations towards you on the basis of Art. 6 Para. 1 S.1 lit. c) GDPR and / or on the basis of our legitimate interest in answering your request on the basis of Art. 6 Para. 1 S.1 lit. f) GDPR.

3. If you provide us with health data as part of your inquiry, we will process this personal data only and to the extent that this is necessary to answer your inquiry and you have given us your express consent to do so within the meaning of Art. 6 Para. 1 S. 1 lit. f) GDPR.

4. For the use of WhatsApp, the data protection information of the messenger service you are using applies. Please refer to the corresponding data protection information for further details:
https://www.whatsapp.com/legal/#privacy-policy

After concluding your rental agreement with us, we will send you information e-mails about similar real estate properties and services of the Vonovia Real Estate Group to the e-mail address you have provided. We process your data on the basis of our legitimate interest in advertising our products and services, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR, § 7 Para. 3 UWG.

We carry out regular customer surveys to measure and promote customer satisfaction. Our tenants either receive a link by e-mail or SMS or are contacted by telephone. If you take part in a customer survey, we process your personal data on the basis of our legitimate interest in improving our products and services according to your needs and wishes, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

We are represented on various social media channels (currently Facebook, Instagram and Twitter) where we regularly publish reports and photos to inform you about us and our products and services. The social media channels give you the opportunity to respond to our "posts" and communicate with us. We may process your personal data on the basis of our legitimate interest in answering your comments / questions / suggestions and advertising our products and services on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.
For the use of Facebook, Instagram and Twitter, the data protection information of the social media channel you use applies. Please refer to the corresponding data protection information for further details:

https://www.facebook.com/privacy/explanation
https://help.instagram.com/155833707900388
https://twitter.com/de/privacy

If you do not or not sufficiently fulfill your obligations under the rental agreement (e.g. in the case of rent arrears), we reserve the right to initiate measures against you (e.g. warning or termination of the rental agreement concluded with you). If necessary, we may also process data that was not collected directly from you (such as information you provided yourself when concluding your rental agreement), but also data from other sources. For example, this may be the case if we receive complaints from other tenants on the basis of which we issue you a warning/dunning letter or terminate your rental agreement. We process your personal data for the execution and, if necessary, processing of your rental agreement on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

1. In the case of outstanding claims against us (e.g. payment arrears), we track these in receivables management, evaluate them, contact you by telephone in order to provide you with the relevant information and, if necessary, send you a reminder/dunning letter.

2. If, for instance, you fail to comply with your contractual obligations (e.g. rent arrears despite a reminder or improper use of the rental object) and in the context of legal disputes with you, we commission external legal advisers or debt collection companies to provide legal advice and to enforce and/or defend our rights. Under certain circumstances we may also process personal data from other public sources (e.g. credit agencies).

3. We process your personal data for the purpose of implementing the rental agreement with you and, if necessary, processing it on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR and on the basis of our legitimate interest in safeguarding, enforcing and/or defending our legal interests on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.
In the event of violations of duties by our employees as well as in work-related criminal proceedings against our employees, we also commission external lawyers to provide legal advice and to enforce and/or defend our rights. In the processing of these cases, your personal data may also be processed under certain circumstances. We process your personal data on the basis of our legitimate interest in safeguarding, enforcing and/or defending our legal interests on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

Under certain circumstances, we may sell our outstanding receivables to factoring companies, which then collect the receivables on their own behalf. As part of the sale and its preparation, the collection agencies are given access to data related to the outstanding receivables. These also contain personal data. If an outstanding receivable of which you are the creditor is sold, we will inform you about this and about the recipient, i.e. the new debtor. We process your personal data for the purpose of executing the contract with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

In connection with a corporate transaction, a risk assessment (due diligence) is carried out on the Vonovia Real Estate Group company to be sold. Personal data is also processed in this process. The processing of the data is carried out on the basis of our legitimate interest in having the company to be sold checked for sale with the aid of a risk assessment, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

1. If you terminate your rental agreement, you can give us your consent in the acceptance protocol that we may pass on your contact details to potential interested parties for viewing purposes. They can then contact you directly and arrange viewing appointments. You can give your consent both by post and via the online customer portal under "Find your home".

2. The prospective tenant undertakes to treat your contact details confidentially and to use it exclusively for viewing Vonovia Immobiliengruppe properties and for the communication required in this respect. The prospective tenant is prohibited from using your contact data for other purposes. This applies in particular to the transmission of advertising, the inclusion of contact data in address lists or the transmission and sale of contact data to third parties.

We also mediate real estate to prospective buyers. If you are interested, you can contact our customer service by telephone or e-mail or contact us via a contact form on our website (www.vonovia.de). You have the opportunity to inquire about a specific property or to send us your interest profile for a general inquiry. We process your personal data in order to answer your inquiry and to broker the property. If you should decide to purchase a property, we process your personal data for the preparation and conclusion of your sales contract. The processing of your data takes place to initiate and, if necessary, conclude a sales contract with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR and on the basis of our legitimate interest in answering your inquiries on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

We store your personal data in connection with the purchase of a property. This data is subject to statutory retention periods and are therefore stored by us over a longer period of time. For example, there are obligations for storage in accordance with § 257 of the German Commercial Code (HGB) and § 147 of the German Tax Code (AO). Once the retention periods have expired, we will delete this data without you having to ask us to do so. This period is 10 years for real estate purchases. The period begins at the end of the calendar year in which the property passed into your possession.
The data is stored on the basis of Art. 6 Para. 1 S.1 lit c) GDPR.

Incoming real estate offers are recorded in our database. In addition to property data, we may also process personal data such as names, addresses and contact details for private providers. The data processing serves the initiation, conclusion and handling of a purchase contract as well as traceability regarding the first evidence / the commission claims. The processing and storage of your personal data takes place on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

1. We document infringements of duties within our group of companies in order to clarify the facts, inform the specific employee of the infringement of duty, issue a warning if necessary and / or terminate the contract under certain circumstances. The documentation of the infringement of duties may also contain your personal data, depending on the individual case of the infringement of duties.

2. If there is a suspicion of criminal conduct on the part of the employee, we conduct a special investigation to determine the facts of the case, to check whether a criminal offense has been committed and, if necessary, to secure evidence. Under certain circumstances, your personal data may also be processed.

3. Your personal data may also be processed within the framework of audits at Vonovia.

4. We process your personal data in order to comply with our legal obligations on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR. In addition, we also process your personal data on the basis of our legitimate interests to carry out the audits prescribed by the Supervisory Board in order to check the processes and efficiency in the group of companies, to safeguard, enforce and/or defend our legal interests and to guarantee the prevention of cases of fraud and abuse in the company as well as IT and network security within the company, on the basis of Art. 6 Para. 1 S. 1 lit.. f) GDPR.

1. We regularly receive press inquiries. In individual cases, personal data (e.g. the name of a tenant) may also be the subject of these inquiries. For this purpose and in the context of press reports, we process this data on the basis of our legitimate interest in taking a position and, if necessary, correcting a misrepresentation, on the basis of Art. 6 Para. 1 S.1 lit. f) GDPR.

2. We report regularly on our events. In this context, we also take photos and / or videos, store and publish them.

3. In the case of photos / videos that do not specifically depict individual event visitors (such as portraits), but rather pictures of the event in which persons can only be depicted in the crowd and not as individuals, we process this personal data on the basis of our legitimate interest in documenting our events and informing you about them, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

4. We process photos in which individual persons are depicted (e.g. portraits), video sequences (e.g. video recordings with interviews with individual persons) with the consent of the person concerned within the meaning of of Art. 6 Para. 1 S. 1 lit. a) GDPR. We process photos / video sequences of persons from contemporary history on the basis of our legitimate interest in informing the public about the event and its contents, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

We make use of video surveillance at our head office in Bochum. The building of the head office is monitored outside. Inside the building, video surveillance is used in certain spatial areas as well as for specific occasions, e.g. automatically when attempts are made to penetrate access control at the entrance by force. In connection with video surveillance, it cannot be ruled out that personal data may be processed via the recorded image material. The monitored areas are marked accordingly.
Data processing is carried out on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR and serves the following purposes, which at the same time represent Vonovia's legitimate interests:

• Protection of the security of customers, suppliers and employees as well as their property

• Protection of the material and intellectual property of the company

• Exercise and safeguarding of the domiciliary right

• Securing evidence relating to criminal offenses

During normal operation, image files are recorded in a self overwriting memory, the regular storage time is less than 72 hours. When an event triggers an alarm, the recordings are stored in a permanent memory and deleted as soon as they are no longer needed for the purpose of reconstructing the recorded event, at the latest after 7 days.
The following groups of persons are authorized to access the recordings: System administrators, selected employees from the specialist areas of new construction, space management, facility management and security service providers.
In certain cases, recordings can be passed on to law enforcement authorities, depending on their purpose.
Occasionally, video surveillance is also used at the regional locations; information on this can be obtained at the respective location.

If the tenant does not place a forwarding order when moving out, or if he does so late, mail from the former tenant is often still found in the letterbox. After moving out, we remove the name tag from the mailbox immediately. However, if mail is delivered into the former tenant's mailbox, we will destroy it.

1. If you have only applied to us for real estate properties, your data will be stored for 6 months after your request has been rejected by you or by us, unless you continue to be interested in our real estate offers.

2. In addition, we store your personal data for as long and as far as necessary for the purposes for which they are processed.

3. If and to the extent that your personal data is no longer required for processing, we will only store your personal data for as long as you can assert claims against us or we can assert against you (statutory limitation period as a rule of three years, beginning at the end of the year in which the claim arises, e.g. §§ 195, 199 of the German Civil Code).

4. In addition, we store your personal data for as long and as far as we are legally obliged to do so. Corresponding duties of proof and storage arise from the German Commercial Code, the Tax Code and the Money Laundering Act (e.g. § 257 HGB; § 147 AO). The storage obligations are ten years.

We transmit your personal data to external parties in the form of order processing as well as to third parties for our own further processing; furthermore within the framework of an internal process within the group for the preparation, execution and, if necessary, processing of your rental contract or purchase contract and, if necessary, for the processing and execution of utilities contracts (such as electricity or gas as well as contracts for television, telephony and Internet) within the Vonovia Real Estate Group. Transmission is based on our legitimate interest in performing internal administrative activities efficiently on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

1. Within the framework of the real estate brokerage and rental process, we make use of external IT service providers (e.g. DATASEC in-formation factory GmbH, OEDIV Oetker Daten- und Informationsverarbeitung KG, AT AG), which provide us with platforms, databases or tools for our services (e.g. our website and customer portal, various contact options or marketing measures) and process personal data for us on our behalf.

2. We use a chatbot from Microsoft Azure to answer inquiries from interested parties when searching for real estate and booking viewing appointments as well as inquiries from tenants. Your personal data will be processed for us on our behalf. In connection with the use of Microsoft Azure, your personal data will be transferred to the USA. The Microsoft Corporation is subject to the EU-U.S. Privacy Shield. This ensures adequate protection of your personal information. The complete text of the EU-U.S. Privacy Shield Framework can be found under the following link:
https://www.privacyshield.gov/servlet/servlet.FileDownload?file=015t00000004qAg

3. To conduct customer surveys, we use external service providers (agencies) who process your personal data for us on our behalf.

4. For the reading of meter readings (heating, water etc.) and legally prescribed controls (e.g. drinking water, smoke detectors) we employ external service providers. We will send your name and address to these service providers. The appointment usually takes place through a notice in the building or the announcement via a notification card in the mailbox.

5. The external service providers we commissioned were carefully selected by us and commissioned in writing. They are bound by our instructions and are regularly inspected by us. All systems in which your personal data is stored and to which external service providers have access are password-protected and only accessible to a certain group of people who require the data for processing the purposes authorized by you. In this context, we ensure in all transmissions and data processing by external service providers within the framework of the statutory provisions that the data is processed, used and, if necessary, transmitted in the manner agreed here.

1. In order to carry out viewing appointments, we may transfer your personal data to external brokers. The transmission serves the execution of your viewing appointment and takes place for contract initiation with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

2. By signing the reservation protocol, we transfer your personal data to credit rating service providers and address identification companies (Section 2.8.). We transmit your data to infoscore Consumer Data GmbH, Rheinstr., Germany, for the purpose of credit assessment, obtaining information to assess the risk of non-payment on the basis of mathematical-statistical procedures using address data. 99, 76532 Baden-Baden, Creditrefom e.V., ¬Adressermittlungsunternehmen or comparable service providers. The legal bases that these transmissions are subject to are Art. 6 Para. 1 S. 1 lit. b) and lit. f) GDPR. Further information can be found at the following link:
https://finance.arvato.com/icdinfoblatt

3. If you have given us a SEPA direct debit mandate to collect your rent including the ancillary costs under the rental agreement, we will transfer your personal data to banks in order to collect the rent including the ancillary costs under the rental agreement. The transmission of your data takes place for the implementation of your rental contract with us on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

4. In the event of repair measures and damage, we may commission external service providers (such as craftsmen) to carry out repairs and remedy damage. Under some circumstances, we may process your personal data to implement the rental contract with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR, due to our legal obligation to maintain the rental property (§ 535 para. 1 German Civil Code) on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR and due to our legitimate interest to maintain and modernize our real estate properties and to process claims through our insurance companies, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

5. As part of construction cost grants, we transfer your personal data to nursing insurance funds. Your personal data will be transferred on the basis of your declaration of assignment, with which you authorized us to apply for the subsidy from the nursing care insurance fund, on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

6. If you apply for a residence entitlement certificate, we will be requested by the housing office of the relevant city to fill out an appropriate form. We will send the completed form back to the responsible housing office so that you can be issued a housing entitlement certificate. In doing so, we transmit your personal data to fulfil our legal obligations on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR.

7. Under certain circumstances, authorities, utilities and network operators may ask us whether you are still a tenant with us. We transmit your personal data (last name, first name and current address) to the requesting party if the relevant requirements are met, on the basis of our legitimate interest in answering the requests; on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

8. Some of our real-estate properties are for sale. If they are rented, we will send the tenant file for the respective object with the tenant data and a list of the credit balance of the deposit account to the buyer of the object after conclusion of the purchase contract. Within the scope of property sales, your personal data may also be transmitted to brokers, notaries and banks. We process your personal data in order to comply with our legal obligations when selling our properties to the buyer on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR and on the basis of our legitimate interest in selling our rental properties and taking all necessary measures in connection with the sale on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

9. Should you fail to comply with your contractual obligations (e.g. rent arrears despite reminders or improper use of the rental object) and within the framework of legal disputes with you, we may transfer your personal data to credit agencies, external lawyers and, under certain circumstances, to social managers (e.g., for official accompaniment), in order to execute the rental agreement with you and, if necessary, to process it, on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR and on the basis of our legitimate interest in safeguarding, enforcing and/or defending our legal interests, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

10. Should you fail to meet your payment obligations, we will initiate a collection procedure.
We transfer your personal data to debt collection service providers in order to carry out the debt collection procedure. We process your personal data in order to execute and process the contract with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR and on the basis of our legitimate interest in asserting our legal claims, including collection, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

11. In the event of the sale of outstanding receivables, we transfer personal data to factoring companies for the purpose of fulfilling the contract with you on the basis of Art. 6 Para. 1 S. 1 lit. b) GDPR.

12. In connection with corporate transactions, we commission external legal counsel to carry out a risk assessment (due diligence). In doing so, we also transmit personal data. The transfer of your data takes place on the basis of our legitimate interest in having the company to be sold checked for sale with the aid of a risk assessment, on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

13. As part of special audits with regard to suspected criminal conduct by employees and in the case of audits, we make use of supporting service providers (such as auditing companies). In order to carry out the audit, we may transfer your personal data in order to comply with our legal obligations on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR and on the basis of our legitimate interests to carry out the audits specified by the Supervisory Board in order to check the processes and efficiency in the group of companies, to safeguard, enforce and/or defend our legal interests and to prevent cases of fraud and abuse in the company on the basis of Art. 6 Para. 1 S. 1 lit. f) GDPR.

14. In addition, we transmit your personal data only to the extent that we are legally obliged to do so. Transmission takes place on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR.

1. We process your personal data within the meaning of paragraph 2 on the basis of our legitimate interests to provide you with information on our products and services on our websites and to guarantee IT security for you when you visit our websites, to carry out analyses and to improve our website and our products and services on the basis of these analyses, fraud prevention, to provide you with information about our real estate offers and services and to provide you with special functions for this purpose (such as calling up favorites the next time you log in), to avoid a payment default on your part, to maintain and modernize our real estate properties as well as to settle claims via our insurance companies, to assert legal claims and / or enforce them, to be able to offer our tenants modernizations on request, to process invoices and payments efficiently, to advertise our products and services, to improve our products and services according to your needs and wishes, to answer your inquiry, to answer your comments / questions / suggestions, to prevent fraud and abuse in the company, to ensure IT and network security within the company, to have the company to be sold checked for sale with the help of a risk assessment, to handle press inquiries and, if necessary, to correct a misrepresentation, to sell our rental properties and to carry out all measures required in connection with the sale, as well as to carry out internal administrative activities efficiently.
If you have any questions, please contact

Vonovia Kundenservice GmbH,
Postfach 44784 Bochum,
Tel.: +49 234 41 47 000-00,
Fax: +49 234 314 888-4414,
E-mail: service@vonovia.de

2. If we process your personal data on the basis of these legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR), you are entitled to object to the processing of your personal data at any time for reasons arising from your particular situation. We will then no longer process your data for these purpose(s) unless our legitimate interests prevail or the processing serves to assert, exercise or defend legal claims. Irrespective of this, you can object to the processing of your personal data at any time in the case of direct advertising (such as newsletters) without stating reasons. Please direct your inquiries to

Vonovia Kundenservice GmbH,
Postfach 44784 Bochum,
Tel.: +49 234 41 47 000-00,
Fax: +49 234 314 888-4414,
E-mail: service@vonovia.de

3. If you object to data processing, we will process your personal data collected in this context to respond to your inquiry. Your personal data will be processed to fulfill a legal obligation on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR.

1. If you have given us your consent to process your personal data, you can revoke it at any time. The revocation of your consent is effective for the future. The lawfulness of the processing of your personal data until the time of revocation remains unaffected. Please send your revocation in writing, by telephone or by e-mail to

Vonovia Kundenservice GmbH,
Postfach 44784 Bochum,
Tel.: +49 234 41 47 000-00,
Fax: +49 234 314 888-4414,
E-mail: service@vonovia.de

2. Should you revoke your consent, we will process your personal data collected in this context to respond to your inquiry. Your personal data will be processed to fulfill a legal obligation on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR.

1. You can demand from us at any time in accordance with the GDPR that we provide you with information about the personal data concerning you that we process (Art. 15 GDPR),
correct personal data that concerns you and that is incorrect (Art. 16 GDPR) and / or delete (Art. 17 GDPR), block (Art. 18 GDPR) and / or disclose (Art. 20 GDPR) your personal data stored with us.

2. Please send your request to

Vonovia Kundenservice GmbH,
Postfach 44784 Bochum,
Tel.: +49 234 41 47 000-00,
Fax: +49 234 314 888-4414,
E-mail: service@vonovia.de

3. If you assert your rights against us, we will process your personal data collected in this context to respond to your inquiry. Your personal data will be processed to fulfill a legal obligation on the basis of Art. 6 Para. 1 S. 1 lit. c) GDPR.

4. Notwithstanding the above rights, you can lodge a complaint with a data protection supervisory authority if you are of the opinion that the processing of your personal data by us violates the GDPR (Art. 77 GDPR).

5. In addition, you can view, correct, change and/or delete your data in your profile in the online customer portal under "My Profile" and under My Rental Agreements. You may at any time and without prejudice to your rights under section 7 terminate your customer profile in the online customer portal.

1. The provisions of this data protection information (available free of charge at www.vonovia.de/datenschutz) including the cookie policy of Vonovia SE (available free of charge at www.vonovia.de/datenschutz) in the version valid at the time apply (cf. status and version of data protection information).

2. We reserve the right to amend and change the content of this data protection information. The updated data protection information shall apply from its date of validity (cf. status and version of the data protection information).