Responsible office in the meaning of data-protection law

CORPUS SIREO
Real Estate GmbH
Aachener Straße 186
50931 Köln
Phone +49 221 399 00-0
Fax +49 221 399 00-109
E-Mail kontakt@corpussireo.com

• Brokerage
• Lease-out
• Sale
• Purchase

• advertising or market and opinion research, as far as you have not objected to the use of your data;
• obtaining information and exchanging data with credit agencies where this goes beyond our economic risk;
• the examination and optimization of processes for needs analysis;
• the further development of services and products as well as existing systems and processes;
• the disclosure of personal data within the framework of due diligence in the course of company sale negotiations;
• for comparison with European and international anti-terrorist lists, insofar as this goes beyond the legal obligations;
• the enrichment of our data, e. g. by using or researching publicly accessible data;
• statistical evaluations or market analysis;
• of benchmarking;
• the assertion of legal claims and defence in legal disputes which are not directly attributable to the contractual relationship;;
• the restricted processing of data, if a deletion is not possible or only possible with disproportionately high effort due to the special type of storage;
• the development of scoring systems or automated decision-making processes;
• the prevention and investigation of criminal offences, if not exclusively for the fulfilment of legal requirements;
• building and plant security (e. g. by means of access control and video surveillance), insofar as this goes beyond the general duties of care;
• internal and external investigations, safety reviews;
• any monitoring or recording of telephone conversations for quality control and training purposes;
• Preservation and maintenance of certifications of a private-law or official government nature;
• the seizure and exercise of domestic authority by means of appropriate measures as well as video surveillance for the protection of our customers and employees as well as for securing evidence in the event of criminal offences and their prevention.

Purposes within the framework of your consent (Art. 6, section 1 a of the GDPR)
Your personal data can also be processed for certain purposes (e.g. use of your e-mail address for marketing purposes) as a result of your consent. As a rule, you can revoke this consent at any time. This also applies to the revoking of declarations of consent that were issued to us before the GDPR went into effect, i.e. prior to 25 May 2018. You shall be separately informed about the consequences of revocation or refusal to provide consent in the re-spective text of the consent.
Generally speaking, revocation of consent only applies to the future. Processing that takes place prior to consent being issued is not affected by such and remains lawful.

• ­personal data (name, date of birth, place of birth, nationality, marital status, occupation/trade and comparable data)
• ­contact data (address, e-mail address, telephone number and similar data)
• ­address data (population register data and comparable data)
• ­payment confirmation/confirmation of cover for bank and credit cards
• ­information about your financial situation (creditworthiness data including scoring, i. e. data for assessing the economic risk)
• ­customer history
• ­data about your use of the telemedia offered by us (e. g. time of access to our websites, apps or newsletter, clicked pages/links of us or entries and comparable data)
• ­Video data

• in connection with the execution of the contract;
• for purposes where we are obligated or entitled to give information, notification or forward data (e.g. employer's liability insurance association, health insurance schemes, fiscal authorities) in order to meet statutory requirements or where the forwarding of data is in the public interest (see number 2.4);
• commissioned by us process data as contract processors or parties that assume certain functions (e.g. external data centres, support and maintenance of IT applications, archiving, document processing, call centre services, compliance services, controlling, data screening for anti-money laundering purposes, data validation and data protection. Plausibility check, data destruction, purchasing/procurement, customer administration, lettershops, marketing, media technology, research, risk controlling, billing, telephony, website management, auditing services, credit institutions, printing plants or companies for data disposal, courier services, logistics);
• as a result of our legitimate interest or the legitimate interest of the third party within the framework of the purposes cited under number 2.2 (e.g. to government authorities, credit agencies, collection agencies, attorneys, courts of law, appraisers, companies belonging to company groups and bodies and control instances);
• if you have given us consent to transmit data to third parties.

Length of time your data is stored
We process and store your data for the duration of our business relationship. This also includes the initiation of a contract (precontractual legal relationship) and the execution of a contract.

Above and beyond this, we are subject to various retention and documentation obligations that emanate inter alia from the German Commercial Code (HGB), the Makler- und Bauträgerverordnung (MaBV) and the German Tax Code (AO). The periods and deadlines for retention and/or documentation stipulated therein are up to ten years beyond the end of the contractual relationship or the precontractual legal relationship.

Furthermore, special statutory provisions may require longer retention such as for example the preservation of evidence in connection with statutory time-barring provisions (statute of lim-itations). Under §§ 195 ff. of the German Civil Code (BGB), the regular time-barred period is three years, but time-barred periods of up to 30 years may also be applicable.

If the data is no longer required to meet contractual or statutory obligations and rights, it is regularly deleted unless its further processing - for a limited period - is necessary to fulfil the purposes listed under number 2.2 due to an overriding legitimate interest. Such an overriding legitimate interest is deemed to be the case, for example, if it is not possible to delete the data as a result of the special type of storage or such is only possible at an unreasonably great expense and processing for other purposes is excluded by appropriate technical and organisational measures.                        

• Thus, you have the right to receive information from us on the data stored on you in accordance with the rules of Art. 15 of the GDPR (if applicable with restrictions in accordance with § 34 of the German Federal Data-Protection Act (BDSG)).
• If you so request, we shall correct data stored on you in accordance with Art. 16 of the GDPR if such data is incorrect or flawed.
• If you so desire, we shall delete your data in accordance with the principles of Art. 17 of the GDPR if such is not prevented by other statutory provisions (e.g. statutory retention obligations or the restrictions laid down in § 35 of the German Federal Data-Protection Act (BDSG)) or an overriding interest on our part (for example, to defend our rights and claims).
• Taking into account the preconditions laid down in Art. 18 of the GDPR, you can demand that we restrict the processing of your data.
• Furthermore, you can file an objection to the processing of your data in accordance with Art. 21 of the GDPR, as a result of which we have to stop processing your data. This right of objection only applies, however, if very special circumstances characterise your personal situation, whereby the rights of our company may run counter to your right of objection.
• You also have the right to receive your data in accordance with the arrangements laid down in Art. 20 of the GDPR in a structured, commonplace and machine-readable format or transmit such data to a third party.
• You furthermore have the right to revoke consent that has been issued to us to process personal data at any time effective into the future (see number 2.3).
• You are in addition entitled to file a complaint with a data-protection supervisory authority (Art. 77 of the GDPR). We recommend, however, to first always send a complaint to our data-protection officer.