Institute for Federal Real Estate Privacy Policy
We take data protection very seriously, which is why we have put together the following overview to provide you with information about how we process your personal data and about your rights under data protection law.
Contents
1. General information
2. Data protection information: Using our Website
1. General information
1.1 Who is responsible for data processing and who can you contact?
The controller responsible for data processing is the Institute for Federal Real Estate
Bundesanstalt für Immobilienaufgaben
Ellerstraße 56
D-53119 Bonn
Tel.: +49 (0)228 37787-0
Email: Info@bundesimmobilien.de
De-mail: poststelle@bundesimmobilien.de-mail.de
Internet: www.bundesimmobilien.de
You can contact our Data Protection Officer at
Bundesanstalt für Immobilienaufgaben
Datenschutzbeauftragte
Ellerstraße 56
D-53119 Bonn
Email: Datenschutz@bundesimmobilien.de
1.2 What are the legal bases for and the purposes of data processing?
We process your personal data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the freedom of movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), Parts 1 and 2 of the Federal Data Protection Act of 30 June 2017 and, where applicable, other specific statutory provisions (to which reference is made where relevant in the following).
1.3 What rights do you have?
Each data subject has the right to information about how we use their data ("right of access", Article 15 of the GDPR), the right to ask that we correct any data they have provided to us ("right to rectification", Article 16 of the GDPR), the right to ask us to delete their data ("right to erasure", Article 17 of the GDPR), the right to ask us to limit the processing of their data ("right to restriction of processing", Article 18 of the GDPR), the right to object (Article 21 of the GDPR) and the right to receive the data concerning them and to transfer it elsewhere ("right to data portability", Article 20 of the GDPR). The restrictions set out in sections 34 and 35 of the Federal Data Protection Act apply to the right of access and the right to erasure.
You may withdraw your consent to the processing of your personal data at any time by contacting the agency to which you gave consent. The same applies in regard to withdrawing consent given before the date on which the GDPR came into effect, that is 25 May 2018. Please note that withdrawing consent will only be effective for the future. Any data processing done before consent was withdrawn will not be affected.
Should you wish to exercise any of the above data protection rights, please contact the controller responsible for data processing (for details see above).
If you have any questions whatsoever regarding the processing of your personal data or exercising your rights under the GDPR, please contact the Institute for Federal Real Estateʼs Data Protection Officer. You can either write to her at the Institute for Federal Real Estate, Bonn Office, Ellerstraße 56, D-53119 Bonn, or contact her by email: Datenschutz@bundesimmobilien.de.
If you wish to do so, you can also lodge a complaint with the data protection supervisory authority (Article 77 of the GDPR in conjunction with section 19 of the Federal Data Protection Act). The supervisory authority responsible for the Institute for Federal Real Estate is the Federal Commissioner for Data Protection and Freedom of Information: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit, Graurheindorfer Straße 153, D-53117 Bonn, tel.: +49 (0)228 997799-0, fax: +49 (0)228 997799-5550, email: poststelle@bfdi.bund.de.
1.4 Right to object under Article 21(1) of the GDPR
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) of Article 6(1).
Should you exercise your right to object, we will no longer process your personal data, unless we can demonstrate compelling legitimate interests in the processing which override your interests or fundamental rights or freedoms, or the processing serves the establishment, exercise or defence of legal claims.
2. Data protection information: Using our website
2.1 What are the legal bases for and the purposes of data processing?
The Institute for Federal Real Estate processes your personal data in accordance with the provisions of the EU’s General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), specifically section 3 of that Act.
2.1.1 Websites and log files
When you visit our websites, our web servers temporarily store every access in a log file. The following data are recorded and stored until they are automatically deleted after seven days:
The IP address of the requesting device
The date and time of access
The name and URL of the data requested
The data volume transferred
Notification of whether or not the action was successful
Identification data of the internet browser and operating system being used
The website providing the link to our website
The name of your internet service provider
These data are processed so that you can use our websites (connection set-up), for the purposes of system security, technical administration of the network infrastructure and to optimize our internet services.
2.1.2 Cookies
Our websites use cookies. Cookies are text files which your internet browser stores on your device. Whenever you visit a website, cookies may possibly be stored. A cookie contains a distinctive sequence of characters which allows for the clear identification of your internet browser the next time you visit the same website.
A session cookie with a session ID and a cookie with log-in information are required for technical reasons so that web pages and all their functionalities can work properly.
2.1.3 Use of Google Analytics
In addition, our websites use cookies to analyse your surfing behaviour on our web pages. Cookies contain no data which can be used to identify a specific data subject.
We use the Universal Analytics version of Google Analytics, a web analysis service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. It allows data, sessions and interaction across several devices to be assigned a pseudonymous user ID and thus user activity across devices to be analysed.
Google Analytics uses cookies in order to collect and analyse information about how you use our websites. For details on our use of cookies, please refer to section 1.1.2 (Cookies).
We use Google Analytics on our websites with the "anonymizeIP" addition. This means that Google already abbreviates and anonymizes IP addresses within European Union Member States or other States party to the Agreement on the European Economic Area. The IP address transmitted from your browser via Google Analytics is not combined with any other data. Google uses this information on our behalf to analyse how you use our website, to compile reports on website activity and to deliver additional services linked to website and internet use. After 14 months Google automatically deletes the transferred data which are linked to cookies, a user ID or advertising ID. For further information go to Google Analyticsʼ Terms of Service and Privacy Policy of Google Ireland Ltd.
You can stop cookies being stored on your device by changing the settings in your browser. Please note that if you do so, you may no longer be able to use all our website functions. You can also prevent the data generated via cookies and data linked to your use of our websites being recorded and prevent Google processing these data by downloading and installing the Browser Add-on. This add-on prevents Google Analytics using your data. To stop Universal Analytics recording data across various devices, you must run the add-on on all the systems you use. To set the opt-out cookie click here: Deactivate Google Analytics.
We use cookies for the purpose of improving the quality of our websites and content. Cookies are used to collect information about website use, which enables us to continuously enhance the services we provide to you.
Our websites use the Google Analytics "demographic features" function. This enables reports to be created containing the age, gender and interests of people visiting our sites. These data relate to interest-based Google advertising and third-party user data, and they cannot be assigned to a specific individual. You can deactivate this function at any time via the ad setting in your Google account or you can generally prohibit your data being recorded by Google Analytics as described in the above.
2.1.4 Contact forms
A number of contact forms are provided. They make it easy for you to contact us.
The web server sends all the personal data collected in a contact form to the relevant office in the Institute for Federal Real Estate in an email. These data are not stored on our web server. The data are not encrypted when transmitted.
Your details are only processed for the purpose for which you sent your enquiry. Point (b) of Article 6(1) of the GDPR provides the legal basis for the processing of your personal data, insofar as the data are required to take those steps prior to entering into a contract which are necessary based on your enquiry. The processing of any other data which you provide to us is based on point (a) of Article 6(1) of the GDPR (consent).
Data in contact forms which do not lead to the conclusion of a contract are deleted without delay. Should we conclude a contract with you, the data required in the performance of that contract are stored as long as is necessary.
2.1.5 Registering on the "meine BImA" portal
The "meine BImA" portal provides access to a number of services. You must register on the "meine BImA" portal to use these services.
During the registration process, your title, first name, surname, email address, password, confirmation that you have read our Terms and Conditions of Use and Privacy Policy, and your consent to the processing of your personal data will be recorded. Required fields are marked. We use the double opt-in registration procedure, which means that the registration process is not completed until you have clicked on a link which will be sent to you in an email. Once registration has been completed, you will receive another email confirming this. If the registration process is not completed, the recorded data will be deleted after 24 hours.
After you have successfully registered, we will also process those data which you enter in the course of using "meine BImA". Your personal data will only be stored in connection with the specific service you are using and only as long as is necessary to provide that service to you.
You can deactivate your account at any time via Profil – Sicherheit– mehr. As far as is technically feasible, all those personal data which we have stored for the purposes of providing services via "meine BImA" will be deleted; if this is not possible, the data will be anonymized.
Point (a) of Article 6(1) of the GDPR (consent) provides the legal basis for the processing of your personal data for the purpose of using "meine BImA".
We reserve the right to use those anonymized data which are recorded in the course of your using "meine BImA" for statistical analysis purposes in order to improve our services. It will not be possible to identify the specific data subject.
2.1.6 Newsletter services
If you complete the registration process for a newsletter service, this is interpreted as consent to the processing of your personal data for that purpose. We will then store the data required for the relevant newsletter service as well as proof that you have given your consent. Point (a) of Article 6(1) of the GDPR provides the legal basis for the processing of your personal data for the purposes of providing newsletter services.
You have the right to withdraw your consent at any time. To do so, either follow the link provided in each newsletter or deselect the newsletter in your "meine BImA" profile.
2.1.7 Third-party services and content
Our websites integrate services and content provided by third parties. When you access a website which includes such integrated third-party services and content, your browser transmits personal data to the relevant providers. Your data are then processed in accordance with those third-party providersʼ privacy policies. Please consult the relevant third-party providerʼs privacy policy to find out how your personal data are processed.
2.1.7.1 Images provided by Immobilienscout24
Our real estate portal is operated in cooperation with Immobilien Scout GmbH, Andreasstraße 10, 10243 Berlin, Germany via an interface (ImmobilienScout-API). We integrate images on our website which are retrieved from Immobilien Scout GmbHʼs servers.
We use images provided by Immobilien Scout GmbH in the interests of making our websites visually appealing.
Click here to read Immobilien Scout GmbH’s Privacy Policy.
2.1.7.2 Use of Google Maps
Our websites use Google Maps via an interface (API) to visualize geographical information. Google Maps is a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
We use Google Maps in the interests of making our websites visually appealing and making it easier for you to locate the buildings/places to which reference is made on our websites.
Click here to read Google Ireland Ltd.ʼs Privacy Policy.
2.1.7.3 Videos provided by Vimeo
We embed videos provided by Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA on our websites.
We embed videos provided by Vimeo Inc. in the interests of making our websites visually appealing.
Click here to read Vimeo Inc.ʼs Privacy Policy.
2.2 Who has access to your data?
2.2.1 Internally
Those offices within the Institute for Federal Real Estate which require your data to perform their tasks and fulfil their contractual and statutory obligations have access to your data.
2.2.2 Externally
We use third-party services providers (processors) to process data in accordance with Article 28 of the GDPR. The data required to provide the service in question will be disclosed to these third parties.
In all other cases, we may only disclose your personal data when required to do so by law or where this is necessary for each specific purpose.
2.3 How long do we store your data?
We will process and store your personal data for as long as we are required to do so by law or if those data are essential for technical or organizational reasons, for troubleshooting purposes or investigating instances of data misuse. Where the exercise of any rights to intervene require their deletion, the relevant data will be deleted without delay.
2.4 Are you obliged to provide us with your data?
You are not obliged to provide us with any of your data. However, if you do not provide us with any data, some of our services will not be available for you to use.
2.5 We are, in some cases, obliged to collect certain personal data
We are required, for example, to obtain your consent for documentation purposes and to store that consent on the basis of statutory requirements (point (c) of Article 6(1) in conjunction with Article 7(1) of the GDPR).
As at: 3 May 2021