1. Overview

This privacy policy serves to provide information about the processing of your personal data in connection with the processing activities described in this privacy policy by companies of HAHN-Immobilien-Beteiligungs AG. Personal data within the meaning of this privacy policy corresponds to the definition in Regulation (EU) 2016/679 (European General Data Protection Regulation, „GDPR“).

2. Name and contact details of the controller responsible for processing, as well as the company data protection officer

Please refer to Section 3 below for the respective controllers responsible for the processing of your personal data. All controllers are located at Buddestraße 14, 51429 Bergisch Gladbach, Germany.

You can reach the responsible company data protection officer of HAHN-Immobilien-Beteiligungs AG at the address mentioned above as well as follows:

Anna Schäfer

Email:  security-desk@vivacis.de 
Phone: +49 6172 6875 515

3. Type and purpose of the processing of personal data as well as legal bases for the individual processing activities

a) Visiting the website

When you visit our website https://www.hahnag.de/ personal data is automatically sent to our website's server by the browser used on your end device. This personal data is temporarily stored in a so-called log file for as long as is technically necessary (a maximum of seven calendar days) to operate the website securely and functionally.  

The data controller responsible for the processing of your personal data is HAHN-Immobilien-Beteiligungs AG, unless otherwise specified in sections 4 to 6 below.

The following personal data is processed without your action and automatically deleted within seven calendar days: 

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which the request originates (referrer URL)
• the browser you are using and, if applicable, your computer's operating system, as well as the name of your Internet service provider 

The personal data mentioned will be processed by us for the following purposes:

• Ensuring that the website loads smoothly
• Ensuring a comfortable use of our website
• Evaluation of system security and stability, as well as
• for further administrative purposes

The legal basis for data processing is Article 6(1), first sentence, subparagraph (f) of the GDPR (legitimate interest). Our legitimate interest stems from the purposes of data processing listed above. Under no circumstances do we use the processed data for the purpose of drawing conclusions about your identity. In addition, we use analytics services when you visit our website. You can find more detailed information on this in sections 4 and 5 of this Privacy Policy.  

b) Sign up for our newsletter

Provided that you have expressly consented in accordance with Article 6(1), first sentence, letter a of the GDPR, we will use your email address to send you our sales newsletter on a regular basis. A double opt-in procedure is used for newsletter registration. DeWert Deutsche Wertinvestment GmbH is the controller responsible for processing your personal data.

To receive the newsletter, providing an email address is sufficient. You can unsubscribe and revoke your consent at any time, for example, via a link at the end of each newsletter. Alternatively, you are welcome to send your unsubscribe request to datenschutz@hahnag.de by email at any time.

c) Use of our contact form

If you have any questions, we offer you the option to contact us using the form provided on our website. You must provide a valid email address so that we know who is sending the inquiry and can respond to it. Additional information is optional.
The data processing for the purpose of contacting us is based on the contact inquiry submitted by you (Art. 6 para. 1 sentence 1 lit. f GDPR).

The controller for the processing of your personal data is HAHN-Immobilien-Beteiligungs AG.

The personal data we process when you use the contact form will be automatically deleted once your inquiry has been resolved.

d) Investor management

Based on the legal grounds set forth in Article 6(1), sentence 1, subparagraph (b) of the GDPR (performance of a contract) and Article 6(1), sentence 1, subparagraph (c) of the GDPR (compliance with legal obligations), we process the following personal data for the purposes of (tax) identification of the contracting party, to facilitate correspondence, for payment transactions, and to conduct the adequacy assessment:

• Investor identification information (name, company, title, form of address, job title, address, phone number, and, if applicable, email address)
• Tax and financial information (account information, tax office, tax ID, tax number, investment amount)
• Date and Place of Birth
• Nationality
• Information from an ID card or passport

DeWert Deutsche Wertinvestment GmbH and HAHN Fonds und Asset Management GmbH are responsible for processing your personal data.

Your personal data will be deleted upon termination of the contractual relationship and after the statutory retention periods have expired.

For the purposes mentioned above, your personal data may be disclosed to affiliated companies and IT service providers of the Hahn Group, trustees, custodians, intermediaries, tax advisors, auditors, and financing banks.

e) Distribution Partner Management

Based on the legal grounds set forth in Article 6(1), first sentence, subparagraph (b) of the GDPR (performance of a contract) and Article 6(1), sentence 1, subparagraph (c) of the GDPR (compliance with legal obligations), we process the following personal data for the purposes of (tax) identification of the contractual partner, to facilitate correspondence, and for payment transactions:

• Identification information for sales partners and contacts (name, company, title, form of address, job title, address, phone number, and, if applicable, email address)
• Tax and financial information (account information, tax office, tax ID, tax number).
• Information from an ID card or passport

DeWert Deutsche Wertinvestment GmbH is the controller responsible for processing your personal data.

Your personal data will be deleted upon termination of the contractual relationship and after the statutory retention periods have expired.

For the purposes mentioned above, your personal data may be disclosed to affiliated companies and IT service providers of the Hahn Group, as well as to tax advisors and auditors.

f) Property/tenant management

Based on the legal grounds set forth in Article 6(1), first sentence, subparagraph (b) of the GDPR (performance of a contract) and Article 6(1), sentence 1, subparagraph (c) of the GDPR (compliance with legal obligations), we process the following personal data for the purposes of (tax) identification of the contractual partner, to facilitate correspondence, and for payment transactions:

• Identification data of tenants and contact persons (name, company, title, salutation, job title, address, telephone number, email address if applicable)
• Tax and financial data (account details, tax office, tax ID, tax number)
• Information from an ID card or passport

The data controller responsible for the processing of your personal data is HAHN Fonds und Asset Management GmbH.

Your personal data will be deleted upon termination of the contractual relationship and after the statutory retention periods have expired.

For the aforementioned purposes, your personal data may be transmitted to affiliated companies and IT service providers of the Hahn Group, tax advisors, auditors, and financing banks.

g) Management of other business contacts (e.g. in connection with mailings)

Based on the legal bases of consent (Art. 6 para. 1 sentence 1 lit. a GDPR) and legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), we process the following personal data for the purpose of sending information and promotional material: 

• Identification data of contact persons (name, company, title, salutation, job title, address, phone number, e-mail address if applicable)

The controllers for the processing of your personal data are DeWert Deutsche Wertinvestment GmbH, HAHN Fonds und Asset Management GmbH, and HAHN-Immobilien-Beteiligungs AG.

We store your personal data in accordance with your consent given separately at the time until you request us to delete it. You can request deletion or revoke your consent at any time by sending us an email to: datenschutz@hahnag.de. For the legal basis of legitimate interest, we have implemented a deletion routine according to which we automatically delete your personal data once the legitimate interest ceases to apply. As outlined in Section 8, you also have the right to object at any time.

For the aforementioned purposes, your personal data may be transmitted to affiliated companies and IT service providers of the Hahn Group.

h) Service provider management

Based on the legal grounds set forth in Article 6(1), first sentence, subparagraph (b) of the GDPR (performance of a contract) and Article 6(1), sentence 1, subparagraph (c) of the GDPR (compliance with legal obligations), we process the following personal data for the purposes of (tax) identification of the contractual partner, to facilitate correspondence, and for payment transactions:

• Identification data of service providers and contact persons (name, company, title, salutation, job title, address, telephone number, email address if applicable)
• Tax and financial data (account details, tax office, tax ID, tax number)
• Information from an ID card or passport

The controllers for the processing of your personal data are DeWert Deutsche Wertinvestment GmbH, HAHN Fonds und Asset Management GmbH, and HAHN-Immobilien-Beteiligungs AG.

Your personal data will be deleted upon termination of the contractual relationship and after the statutory retention periods have expired.

For the purposes mentioned above, your personal data may be disclosed to affiliated companies and IT service providers of the Hahn Group, as well as to tax advisors and auditors.

i) Personal data of the shareholders of HAHN-Immobilien-Beteiligungs AG

Based on the legal basis of the German Stock Corporation Act (Aktiengesetz) in conjunction with Art. 6 Paragraph 1 c) of the GDPR, HAHN-Immobilien-Beteiligungs AG (hereinafter also referred to as „we“) processes personal data of its shareholders and their authorized representatives for the purposes provided for in the German Stock Corporation Act (AktG). These purposes include, in particular, maintaining the share register, communicating with shareholders, and organizing general meetings (e.g., verifying eligibility to participate, preparing the list of participants, and enabling the exercise of shareholder rights during the general meeting). In addition, personal data of shareholders may also be processed to comply with other legal obligations, such as regulatory requirements and retention obligations under stock corporation, commercial, and tax law. For example, when granting a proxy to the voting representatives appointed by the company for the general meeting, it is mandatory to verifiably record and store the data serving as proof of the proxy in an access-protected manner for three years (Section 134 Paragraph 3 Sentence 5 of the AktG).
Furthermore, we are also authorized to process personal data to safeguard legitimate interests or the legitimate interests of a third party in accordance with Art. 6(1)(f) GDPR. This is the case, for example, when analyses and statistics are prepared to illustrate the shareholder structure and development, or when overviews of the largest shareholders are compiled.

In this context, we process the following personal data of the shareholder and the representative authorized by them:

• Personal data (e.g., first and last name, title if applicable, birth name if applicable, date of birth, gender, nationality, profession/industry, address, and further contact details (e.g., shipping address, email address, phone number))
• Shareholder data and information on the shareholder's stockholding (shareholder number, shareholder category (natural or legal person), holding, type of ownership, history of additions and disposals, settling bank)
• if applicable, name, address, and further contact details of the authorized representative
• Registration data for the General Meeting (registered or represented shareholder with first and last name as well as place of residence, the number of shares represented by them, admission card number) 

4. Analysis Tools

a) Tracking tools

The tracking measures listed below and used by us are carried out on the basis of Art. 6 Para. 1 S. 1 lit. f GDPR. With the tracking measures used, we want to ensure a demand-oriented design and the continuous optimization of our website. On the other hand, we use tracking measures to statistically record the use of our website and evaluate it for the purpose of optimizing our offer for you. These interests are to be regarded as legitimate within the meaning of the aforementioned provision.
The respective purposes of data processing and data categories can be found in the corresponding tracking tools. 

b) Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited („Google“). Google Analytics uses cookies, which enable an analysis of your use of our website. The information generated by the cookie about your use of our website (including your IP address) is generally transmitted to and stored on a Google server in the USA. Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services associated with website and internet usage. We use Google Analytics exclusively with activated IP anonymization. The processing of data is based on Art. 6 (1) (a) GDPR. 

c) Google AdWords

To promote our websites, we use „Google AdWords“ and, in this context, the „Conversion Tracking“ service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA). As a result, if a user reaches our websites via a Google ad, a so-called „conversion cookie“ is placed on the user's computer (for the definition of cookies, see section VI). Conversion cookies have a limited validity and are not used to identify the data subject. The conversion cookie collects information about the user's activities on our websites (such as browsing behavior or visited subpages of our online offering). All usage data is stored using a pseudonym, so that a personal identification is generally excluded. 
Furthermore, Google uses the information collected via the conversion cookie to compile visitor statistics for our websites. This tells us the total number of users who were directed to us via AdWords ads. The collected information as well as the user's IP address are transmitted to Google in the USA and stored there. Google may share this data with third parties.
Further information on Google AdWords conversion tracking can be found at the following link:
https://support.google.com/adwords/answer/1722022?hl=de

Purpose of data processing
The purpose of Google AdWords is the targeted promotion of our websites. The visit statistics serve to analyze the impact and efficiency and thus to optimize our AdWords ads. These purposes also constitute our legitimate interest in the processing of this data pursuant to Art. 6 para. 1 lit. a GDPR.

Right to object and remedy
Users can prevent the storage of cookies by adjusting their browser software settings and thus permanently object to the setting of cookies. In addition, any cookie already set by Google can be deleted at any time via the internet browser or other software programs. Furthermore, users can deactivate personalized advertising in Google's ad settings. Instructions for this can be accessed at the following link: https://support.google.com/ads/answer/2662922?hl=de

d) Google Font API

Our website uses the Google Fonts API, a service provided by Google Ireland Limited („Google“), to ensure a uniform display of fonts. When you access a page, your browser loads the required fonts into your browser cache to display texts correctly. In the process, your IP address is transmitted to Google. Google generally processes the data on servers in the USA. No cookies are set or other personal data stored. The processing is based on Art. 6 para. 1 lit. a GDPR. 

e) Google Tag Manager

This website uses Google Tag Manager, a service provided by Google Ireland Limited („Google“). This service allows website tags to be managed via an interface. Google Tag Manager itself does not process any personal data; it merely triggers other tags that may collect data. We have no control over this processing. This usage is based on Art. 6 (1) (a) GDPR for the efficient management of website tags.

f) Cloudflare JS

We use Cloudflare JS, a service provided by Cloudflare, Inc., to improve the security and performance of our website. For this purpose, Cloudflare sets cookies to identify recurring users and prevent malicious activity. In the process, data, including your IP address, is transmitted to Cloudflare servers, which may be located outside the EU. This is used on the basis of Art. 6 para. 1 lit. a GDPR. 

g) Vimeo

Our website embeds videos from the platform provider Vimeo. When you visit a page that has a Vimeo video embedded, a connection to Vimeo's servers is established. In the process, your IP address and the information about which of our pages you have visited are transmitted to Vimeo. If you are logged into your Vimeo account, Vimeo can directly associate your browsing behavior with your personal profile. You can find more information on this in Vimeo's privacy policy. The processing is carried out on the basis of Art. 6 (1) lit. a GDPR. 

h) DoubleClick.Net

We use DoubleClick by Google, a service provided by Google Ireland Limited („Google“), to improve the effectiveness of our online advertising. DoubleClick uses cookies to present you with relevant ads and to measure campaign performance. In the process, Google may collect and analyze information about your use of this website. Under certain circumstances, this data may be processed on servers in the USA. You can find further information about DoubleClick's privacy policy at Google. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR. 

5. Social Media Plug-Ins

a) Twitter

We use social plugins of the social network Twitter on our website on the basis of Art. 6 para. 1 sentence 1 lit. a GDPR in order to make our company better known through them. The underlying promotional purpose is to be regarded as a legitimate interest within the meaning of the GDPR. Responsibility for data protection-compliant operation is to be guaranteed by the respective provider. The integration of these plugins by us is carried out by means of the so-called two-click method in order to protect visitors to our website in the best possible way. Plugins of the short message network Twitter Inc. (Twitter) are integrated on our website. You can recognize the Twitter plugins (tweet button) by the Twitter logo on our site. An overview of tweet buttons can be found here (https://about.twitter.com/resources/buttons).

When you visit our website, which contains such a plugin, a direct connection is established between your browser and the Twitter server. Twitter thereby receives the information that you have visited our website with your IP address. If you click the Twitter „Tweet“ button while logged into your Twitter account, you can link the contents of our website to your Twitter profile. This allows Twitter to associate your visit to our website with your user account. 

We would like to point out that we, as the provider of this website, have no knowledge of the content of the transmitted data or its use by Twitter. If you do not want Twitter to be able to associate your visit to our website, please log out of your Twitter user account. Further information on this can be found in Twitter's privacy policy (https://twitter.com/privacy). 

b) XING

This website also uses the „XING share button“ (pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR). When visiting this website, your browser briefly connects to servers of XING SE („XING“) to provide the „XING share button“ functions (in particular the calculation/display of the counter value). XING does not store any of your personal data when you visit this website. In particular, XING does not store IP addresses. Furthermore, there is no evaluation of your usage behavior via the use of cookies in connection with the „XING share button.“ You can access the current data protection information regarding the „XING share button“ and additional information on this website: https://www.xing.com/app/share?op=data_protection 

c) LinkedIn

Whenever you access one of our pages that contains LinkedIn features, a connection to LinkedIn's servers is established. LinkedIn is informed that you have visited our internet pages with your IP address. If you click LinkedIn's “Recommend” button while logged into your LinkedIn account, LinkedIn is able to associate your visit to our internet page with you and your user account. We point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by LinkedIn.

The use of the LinkedIn plugin is based on Art. 6 para. 1 lit. a GDPR. The website operator has a legitimate interest in achieving the greatest possible visibility in social media.

For more information, please refer to LinkedIn's privacy policy at: https://www.linkedin.com/legal/privacy-policy. 

d) Twitter CDN

Our website embeds content via Twitter's Content Delivery Network (CDN). When retrieving this content, your IP address is transmitted to Twitter. Twitter may use this data for analytical purposes. Further information on data processing by Twitter can be found in their privacy policy. The processing is based on Art. 6 para. 1 lit. a GDPR. 

6. Rights of Data Subjects

With regard to all processing of personal data presented in this privacy policy, you have the right

• to request information, pursuant to Art. 15 GDPR, about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your personal data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing, or objection, the existence of a right to lodge a complaint, the source of your data if not collected by us, and the existence of automated decision-making including profiling and, where applicable, meaningful information about the details thereof;
• to demand without undue delay the rectification of inaccurate personal data concerning you or the completion of your personal data stored by us, in accordance with Art. 16 GDPR;
• to request the erasure of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
• to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR, insofar as the accuracy of the data is contested by you, the processing is unlawful, but you refuse its erasure and we no longer need the data, but you require it for the establishment, exercise or defense of legal claims, or you have lodged an objection to the processing pursuant to Art. 21 GDPR;
• pursuant to Art. 20 GDPR, to request the transfer of your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request the transmission of those data to another controller;
• pursuant to Art. 7 para. 3 GDPR to revoke your once granted consent at any time from us. This means that we may no longer continue the data processing that was based on this consent for the future;
• to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR. As a rule, you can contact the supervisory authority of your habitual residence or place of work or our company headquarters for this purpose. 

If you wish to exercise any rights, simply send an email to datenschutz@hahnag.de.

7. Right to object

Insofar as your personal data is processed on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right of objection, which will be implemented by us without specifying a particular situation.

If you wish to exercise your right of withdrawal or objection, an email to datenschutz@hahnag.de is sufficient.

8. Data Security

During your visit to the website, we use the widely adopted SSL (Secure Socket Layer) procedure in conjunction with the highest level of encryption supported by your browser. As a rule, this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted in encrypted form by the closed display of the key or lock symbol in the status bar of your browser.

We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments. 

9. Currency and Changes to this Privacy Policy