Data Protection Declaration

Here you have the possibility to customize your settings for the use of cookies. If you have not only consented to the use of required cookies, you may withdraw this consent at any time. Existing cookies are then deleted.

1. Overview

Last change: April 2025

With this general data protection information "General Data Protection Information", CA Immo ("we" "us") informs you about how we process your personal data ("data") when you visit our website and in general business contact with you. For some situations, this general data protection information is supplemented by specific data protection information. You can find this on the side of our website on data protection declaration (https://www.caimmo.com/en/data-protection-declaration).

When you visit our online offers, contact us or otherwise have a business relationship with us, we process data from you, such as technical data, your name, your contact information and other data. 

This processing is carried out for various legitimate purposes, for example to present our offers, to communicate with you or to manage our business relationship with you. 

We always ensure that we only process data if we have a legal basis for doing so, such as a legitimate interest, your consent or processing for a contract.

In some cases, we share your data with third parties, such as our group companies, business partners or service providers. Sometimes your data is also processed outside the European Economic Area for this purpose. We then take measures to ensure the security of your data. 

As a rule, we store your data until the purpose for which we have collected your data has been achieved, statutory retention periods exist, or we need your data to fulfil another legitimate purpose, such as the assertion, enforcement or defence of legal claims. 

You have a number of data protection rights, such as the right of access, rectification, erasure, restriction, objection and cancellation, as well as the right to lodge a complaint with a supervisory authority. 

You are not obliged to provide us with your data. However, in some cases we need this data in order to provide our services or conclude a contract with you.

We are aware of the importance of your data and therefore provide detailed information on the individual data processing operations below.
 

2. Area of application

In this general data protection information, we inform you about how we process your data when you 

  • visit our website (www.caimmo.com/en) and its subpages;

  • visit other CA Immo online offers that link to this General Data Protection Information;

  • get in touch with us; 

  • take part in our events;

  • have a business relationship with us 

  • give us feedback or take part in surveys.

In addition, there are some special processing situations in which we have prepared specific data protection information for you. This specific data protection information applies in addition to this general data protection information. If specific data protection information applies to the processing of your data, we have linked it for you on the right-hand side of our website “Data Protection Declaration” (https://www.caimmo.com/en/data-protection-declaration/) and at the relevant point in this General Data Protection Information. 

In addition, some of our buildings ("properties") have their own websites and/or process data on a property-specific basis on a larger scale. You will find separate data protection information for these properties either on the property-specific websites or on the right-hand side of our website "Privacy Policy". 

For the processing activities described in this General Data Protection Information, the

CA Immobilien Anlagen Aktiengesellschaft
Mechelgasse 1
1030 Vienna, Austria
Phone: +43/1/532 59 07

responsible within the meaning of the General Data Protection Regulation ("GDPR"). 

We have appointed a data protection officer who you can contact at service@dsgvoschutzteam.com.

In some cases, we are not solely responsible for the processing of your data, but jointly responsible with others. This means that we jointly decide on the purposes and means of processing. In these cases, we have concluded a contract that regulates this cooperation and clarifies areas of responsibility in particular. You can assert your rights against any of the joint controllers, who will then ensure that your rights are also enforced against the other joint controllers

In the following, we explain which of your data we process, the purposes for which we do this, the legal basis for this and how long we store your data in each case. 

Data recipients. Furthermore, under the heading "Disclosure to third parties", we indicate which third parties receive your data directly from us. In addition, in some cases your data may also be forwarded to other third parties, who may be processors or independent controllers. Such third parties are in particular

  • Other CA Immo Group companies, in particular CA Immo Deutschland GmbH, Friedrich-Ebert-Anlage 35-37, 60327 Frankfurt/Main, Germany, which support us in achieving the purposes stated in this data protection information. A list of CA Immo Group companies to which we may transfer your data can be found at in Appendix 1.

  • our advisors, such as lawyers, tax consultants and notaries, banks, valuers, debt collection agencies, accountants and auditors;

  • Business partners, such as joint venture partners & COA communities (if any), journalists, private shareholders, analysts, buyers/sellers (recipients of services), commercial or technical property manager/facility management ("FM"), contacts at investment companies of any kind, natural investors/shareholders, as well as any other person who expresses a wish to receive investor information or business reports, cooperation partners (to coordinate the distribution list), customers, construction site logistics/general contractors/security contractors (depending on the structuring of the construction process); Centre management; printers/producers; third-party financiers such as leasing or contracting companies and assignees, if the delivery or service is financed by third parties in this way, tenants, neighbours, property/building management (for maps), insurance companies, other contractual partners involved in the service;

  • Authorities (such as: Labour inspectorate/trade supervisory authority, municipal, district administrative and federal authorities, tax office, police/public prosecutor's office, company register/commercial register/land register, Austrian Financial Reporting Enforcement Panel/Federal Financial Supervisory Authority, etc.) and courts;

  • Service providers, such as courier services, market and opinion research institutes, brokers, measurement service providers, press agencies, translators; and

  • potential buyers, investors, insolvency administrators and other third parties who receive data in connection with a transaction such as a merger, sale of assets or shares, reorganisation, financing, change of control or takeover of all or part of our company or in the context of insolvency proceedings.

International data transfers. In some cases, we transfer your data to countries outside the European Economic Area ("EEA"). The GDPR does not apply directly in these countries. For this reason, we ensure that an additional protection mechanism is in place in such cases. These protection mechanisms can be 

  • An adequacy decision by the European Commission. With such a decision, the European Commission determines for a country or a sector in a country that a level of data protection comparable to that of the EU or the EEA exists. Such decisions exist, for example, for Switzerland, the United Kingdom and for companies in the USA that are certified in accordance with the "Data Privacy Framework". The adequacy decisions can be found at commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. For example, we refer to an adequacy decision when we share data with group companies, service providers and business partners in Switzerland.

  • The standard contractual clauses adopted by the European Commission. This is a contract that imposes data protection obligations on the data recipient based in the third country. In order to protect your data against access by third parties, we may have implemented further protective measures. The sample standard contractual clauses can be found at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_de. For example, we use standard contractual clauses when we share data with group companies that are not based within the EEA or Switzerland.

We have indicated under the heading “Transfer to third countries” whether we (directly) transfer your data to third countries.

Origin of the data. Unless otherwise stated in this General Data Protection Information, we (or our processors) collect your data directly from you and do not obtain it from third parties.

Automated decision making. We do not use your data for automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you.

4.1.1. Processing for contract fulfilment and execution

If you contact us because you are considering entering into a contract with us or you or your employer have a contractual relationship with us, we process your data as follows. Not all of the data listed here will be processed in all cases, but the specific data processed will depend on the nature of the relationship between you and us:

Processed data

Purposes

Legal basis 

Storage duration

  • Contact data, such as salutation; title; name; function; company; address; telephone and fax number and other information required for addressing, which result from modern communication techniques; dates of birth (insofar as absolutely necessary for identification); correspondence languages, other agreements and keys for data exchange (hereinafter summarised as "contact data")

  • Tax number / national insurance number;

  • Residence;

  • Identification data;

  • Specimen signature/ sample drawing;

  • Occupation, marital status, (for sales of residential property to private individuals)

  • Dates in connection with the contract;

  • Technical data such as account details, if applicable

  • Payment history, if applicable;

  • Creditworthiness information, if applicable;

  • Contract details;

  • Other information required for the respective contract, such as company registers, land register extracts, allocation to a certain customer and supplier category, identification numbers of official statistics, membership of a certain professional association; tax calculation;

  • Invoice data/financial information

  • Dunning data/complaint data;

  • Service-specific expenses and income; and

  • Data in connection with the conclusion of the contract and its execution, such as offers, investment memoranda, all documents provided in the context of a purchase/sale review.

  • mutual fulfilment of contracts, i.e, for the processing of property purchases and sales, letting of properties, building maintenance, property valuation and for the establishment, fulfilment and termination of other orders placed by you with CA Immo, for the acceptance of services provided by you, but also for invoicing, business-related accounting and archiving and for the accompanying processes inherent in the business relationship between you and CA Immo, such as credit checks, service improvements or accompanying support measures (e.g. complaint and emergency management), tenant expansion, after-sale phase/follow-up support, warranty follow-up). (e.g. complaint and emergency management), tenant development, after-sale phase/aftercare, warranty follow-up);

  • Compliance with legal obligations, such as "know-your-customer" and anti-money laundering obligations;

  • Maintenance of rented or for-sale buildings;

  • Real estate project realisation;

  • corporate actions; and

  • Preparation of tax information and compliance with tax obligations where applicable.

Insofar as the processing of your data for the above-mentioned purposes is absolutely necessary for the fulfilment of a contract concluded with you: 

  • Contract fulfilment

or, in the case of a legal obligation

  • any existing legal obligations, such as obligations to prevent money laundering

or, if you have given us your consent 

  • Your separate consent

or, in all other cases

  • legitimate interest, namely with regard to the purposes described.

CA Immo generally retains your data for the duration of the fulfilment of the contract . In addition, CA Immo is subject to various retention obligations, according to which CA Immo must retain data relating to your person and the contractual relationship beyond the termination of the contract, as is the case, for example, due to the retention periods under company law. This is 7 years for communication relevant to commercial law and 10 years for documents relevant to tax law.

CA Immo will retain your data for as long as it is possible to assert legal claims arising from the business relationship with you. This is usually 4 years, unless shorter or longer limitation periods apply in exceptional cases.

 

Origin of the data

CA Immo processes data that it receives from publicly accessible sources (e.g. company register/commercial register, land register, internet) or credit agencies, estate agents and their property management companies. In the context of project realisations (lettings with and without fit-out, real estate project realisations, property purchases and sales, etc.), we also process data that we receive from other customers and suppliers in the context of these projects (e.g. service providers such as brokers, tradesmen, lawyers, etc. who work on behalf of customers or data from sub-service providers of CA Immo suppliers).

Disclosure to third parties: 

  • The CA Immo Group is organised according to a matrix structure, with central units in Austria and Germany. Within the CA Immo Group, those departments and employees receive data from customers and suppliers who need it to fulfil contractual and legal obligations and to safeguard legitimate interests (supervisory duties, reporting structures, network maintenance);

  • In addition, CA Immo has agency agreements for its subsidiaries under which the data of customers and suppliers of the property holding companies can be forwarded to the respective management companies.

  • CA Immo also operates a contact database for its subsidiaries, which can be used to forward the contact details of customers and suppliers of the subsidiaries to the management companies. Further information on this can be found below under 'Data warehouse'.

  • Finally, it may be necessary for CA Immo to pass on your data to contractual partners or service providers as part of its business relationship with you.

  • A list of the categories of recipients can be found above under "Data recipients".

  • In particular, the following groups of third-party recipients come into consideration, whereby the transfer depends on the specific contract and not all recipients are transferred in all cases:

    • Authorities, such as: Labour inspectorate, municipal, district and federal authorities, tax office, police/public prosecutor's office, company register/land register, OePR, etc;

    • Banks;

    • other (legal) persons obliged to check money laundering regulations (insurance companies, etc.);

    • External accountants [ONLY in HR, NL, SK];

    • competent administrative authorities, in particular tax authorities, company register, land register;

    • Debt collection company without debt transfer;

    • Courier services;

    • Third-party financiers such as leasing or factoring companies and assignees, if the delivery or service is financed by third parties in this way;

    • Contractual or business partners who participate or are to participate in the delivery or service (e.g. construction monitoring companies; IT consultants, insurance brokers, strategy consultants, relocation/space planners);

    • Insurance companies;

    • Broker;

    • commercial property manager;

    • technical property manager & facility management;

    • Rater;

    • Joint venture partners & WEG communities (if available);

4.1.2. Access controls 

If you visit the premises of CA Immo, as well as our properties and construction sites, we may carry out access controls during which your data will be processed. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Contact details;

  • visited person;

  • visited object;

  • Date, time and duration of the visit;

  • access authorisations and restrictions, if applicable;

  • Picture if applicable;

  • ID number;

  • Room key number, if applicable;

  • if applicable: signature; and

  • Vehicle licence plates in conjunction with parking systems.

For suppliers/service providers who receive their own access card, additionally

  • Name;

  • Date and time;

  • Identification (e.g. ID number or access card number);

  • Reader number & location; and

  • Result, whether access authorisation ok.

Some of our properties have a doorbell with an intercom system, which sometimes also transmits live video.

  • Video feed control of the access area (without long-term storage);

  • Sound via intercom; and

  • Date, place and time.

  • Building security;

  • Protection of employees and business secrets;

  • Identification checks;

  • Monitoring of construction sites; and 

  • Digital admission control.

  • Your consent, 

or, if no separate consent has been given, 

  • any existing legal obligations

or, if such legal obligations do not exist,

  • CA Immo's legitimate interest in building security and the monitoring and access control of CA Immo's portfolio properties and construction sites.

 

Provided CA Immo is not subject to any statutory retention obligations to the contrary, CA Immo will retain your data for up to 12 months after completion of construction site monitoring or for 12 months in the case of access controls. Video material is stored for a maximum of 72 hours. This period may be extended if legal claims are asserted.

There is no permanent storage as part of the video-based admission control. A short intermediate storage of a few seconds is possible for technical reasons.

Disclosure to third parties: 

  • Data is only exchanged within the Group to the extent that management companies and the technology department can handle operational business management, as well as due to centralised IT and in the course of auditing.

  • Object/building management (for maps).

  • IT/video security provider.

  • Insurance companies, if applicable.

  • If applicable, the tenant you are visiting.

  • If necessary, the data will be forwarded to external service providers such as property/building management, IT/video security providers, insurance companies, construction site logistics companies/general contractors (depending on the structure of the construction process), authorities, legal representatives & notaries and courts.

Transmission to third countries:

  • Your data will not be transferred to third countries.

4.1.3. Video surveillance 

We have installed video surveillance in some of our properties and construction sites. When you enter these properties, your data is processed. You can find more information on this data processing in our specific privacy policy on video surveillance, which you can access at https://www.caimmo.com/en/cctv.

4.1.4. Data warehouse

CA Immo stores, processes and transmits tenant and supplier data as well as data from CA Immo's internal administrators as part of a data warehouse for standardised Group-wide reporting. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Serial number;

  • Contact details;

  • Assignment to a specific customer and supplier category (including regional assignment, etc.);

  • Data on tax liability and tax calculation;

  • service-specific expenses and income;

  • Property-related information on ongoing letting and management as well as data on the establishment, implementation and termination of rent and operating cost accounting (m², prices, payment conditions, deadlines, deposits, payments, balances, dates, VAT rates, property number, turnover, totals, index values, usable space, rental income, size details, location, property type, property types, storey, etc.);

  • the object of the delivery or service; and

  • Financial information on the service and delivery (payment conditions, payments, balances, dates, VAT rates, sales, totals, etc.).

  • Group-wide standardised reporting; and

  • Group-wide portfolio analyses.

  • Our legitimate interest in achieving the purposes described.

 

CA Immo stores the data in the data warehouse for 10 years.

Disclosure to third parties: 

  • The data is only exchanged within the Group to the extent that management companies are able to fulfil operational business management tasks. Internal recipients include the Supervisory Board, the Group Management Board, the specialised departments for capital market financing, valuation, asset & investment management and controlling. Data is also forwarded due to centralised IT and in the course of auditing. 

  • The data is forwarded to an external IT service provider. CA Immo has concluded an order processing agreement with the external IT service provider to ensure the security of your data. 

  • The data is forwarded to auditors, joint venture partners and WEG communities.

CA Immo only forwards tenant data in pseudonymised form.

Transmission to third countries:

  • Your data will not be transferred to third countries.

4.1.5. Nextcloud

We use the Nextcloud software for file exchange and project planning. You also have the option of registering there to better coordinate processes with us. In this case, we process your data as follows:

Processed data

Purposes

Legal basis 

Storage duration

  • Uploaded or created content such as folders and files including any keywords and notes;

  • Access & rights management for content;

  • Name;

  • E-mail address;

  • Password;

  • Data in connection with project planning or task tracking in projects, e.g. assignment of (sub)tasks, groups (project teams), due date. Keywords;

  • Event logs for all activities (e.g. time of file access, configuration change);

  • uploaded content including keywords, notes and individually set deletion periods; and

  • Communication / Chat.

  • File exchange;

  • Communication;

  • Project coordination and management;

  • Documentation of work steps.

If you have consented to the processing 

  • Your consent 

otherwise

  • our legitimate interest in achieving the purposes described.

No later than 150 days after the user's ID has been deactivated or deleted in the ActiveDirectory or 5 years after the file was created if no shorter deletion period has been set.

Disclosure to third parties: 

  • If this is required for fulfilment, your data may be passed on within the Group companies in individual cases.

  • Project partner.

  • Auditor

Transmission to third countries:

  • Your data will not be transferred to third countries.

4.1.6. Web-based delivery traffic control

We use a web-based tool for better planning of delivery traffic management on our construction sites (online avisation). In these cases, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • contact details; and

  • Data for scheduling coordination (delivery date of the registered journeys with date and time, commissioning construction company, which material, with which type of lorry, via which gate, which unloading point).

  • Planning, preparation and realisation of deliveries to our construction sites;

  • Coordination with other suppliers.

  • Our legitimate interest in achieving the purposes described.

3 months after completion, unless further storage is necessary for the assertion or defence of legal claims.

Disclosure to third parties: 

  • If this is required for fulfilment, your data may be passed on within the Group companies in individual cases.

  • Construction site logistics/security contractor (depending on the structure of the construction process).

Transmission to third countries:

  • Your data will not be transferred to third countries

4.1.7. Construction planning and coordination (Sablono)

In some cases, CA Immo uses an external management platform from Sablono GmbH for construction planning and coordination. Further information on this data processing can be found in our specific data protection information on construction planning and coordination (Sablono), which you can access at https://www.caimmo.com/de/datenschutzerklaerung/sablono/.

We may process data in the course of organising our Annual General Meetings. You can find more information on this data processing in our specific data protection information for the Annual General Meeting, which you can access at https://www.caimmo.com/fileadmin/documents/Investor-Relations/Hauptversammlung/2025/Englisch/CA_Immo_Datenschutzinformation_f%C3%BCr_HV_en_.pdf.

As a listed company, we are subject to a large number of legal obligations, the fulfilment of which may require us to process personal data. We may also conduct legal proceedings, seek legal advice or settle claims with insurance companies. In this case, we process your data as follows, for example: 

Processed data

Purposes

Legal basis 

Storage duration

  • Contact details;

  • If applicable, proof of fulfilment of the Aliens Employment Act: date of birth; nationality; national insurance number; proof of employment; confirmation of residence and work permit; official photo ID;

  • Connection to a person who performs management tasks, children and other closely related persons (spouse, registered partner, family members living in the same household, etc.);

  • If applicable, the type, date, volume and price of the transaction involving shares or other financial instruments of CA Immo;

  • any shares and financial instruments held, including voting rights;

  • Reason for reaching thresholds (purchase/sale of shares, authorisations, etc.);

  • Beneficial owners of the company, as well as authorised signatories on company accounts, data on the reason for qualification as beneficial owner;

  • Relevant data;

  • national identification number;

  • Function and reason for qualification as an insider or as a person with access to confidential data;

  • Period of access to confidential data (start and end);

  • Record of instructions and information in connection with obligations under capital market law;

  • Citations in connection with legally binding publications;

  • Details about the cooperation (transaction information, key data of contracts, etc.); and 

  • Information about the underlying facts (e.g. an accident, contract, etc.).

  • Fulfilment of legal obligations to which we are subject.

  • Obtaining legal opinions, assessments and expert opinions;

  • Enforcement, prosecution or defence of legal claims;

  • Processing and transmission of data (in this case of natural persons) for the preparation of reports (such as AR Litigation Report and litigation list) on (pending) proceedings and procedure-related restitution notifications, including automatically created and archived text documents (such as correspondence) in these matters, as part of the internal control system and risk management required under stock corporation law; 

  • Improvement of internal processes;

  • Management of group accident insurance for the company;

  • claims settlement; and

  • Legal and receivables management.

  • any existing legal obligations,

or, if no such legal obligation exists, but the processing is related to such an obligation:

  • Legitimate interests in achieving the purposes described.

In accordance with the statutory retention periods.

Until the end of the relationship with the data subject and beyond, as long as statutory retention periods exist or as long as legal claims can be asserted.

Disclosure to third parties

  • If required for fulfilment, your data may be passed on within the Group companies in individual cases.

  • IT service provider for maintaining insider lists and listing related parties of executive bodies:

    • EQS Group AG.

  • Authorities such as: FMA, labour inspectorate, municipal, district and federal authorities, tax office, police/public prosecutor's office, company register/land register, OePR, etc.

  • Legal representatives & notaries.

  • Courts.

  • Auditor.

  • IT service provider (publication of ad hoc disclosures).

  • Visitors to the CA Immo homepage (publication of ad hoc announcements).

  • Contact persons at investment companies of any kind, natural investors, and any other person who expresses a wish to receive investor information or annual reports.

Transmission to third countries:

In principle, no data is transferred to third countries. If data is published in ad hoc reports, it cannot be ruled out that this data will also be accessed by recipients in third countries. In individual cases, it may be necessary to transfer data to third countries.

You can register for a newsletter on our website. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Salutation; 

  • First name; 

  • Surname; 

  • Granting of consent, including its content and related metadata;

  • e-mail address; and

  • the newsletter messages including their content and related metadata.

To receive the newsletter, all you have to do is enter your e-mail address and give your consent.

  • We also analyse the opening and clicking behaviour after the newsletter has been sent as well as information on the end device, the email software and the region of the recipient with an evaluation on an anonymised basis. In the first step, we collect whether, when and how often the newsletter was opened and any links contained therein were clicked, as well as which end device and which e-mail software from which region was used for this. This data is aggregated or anonymised after collection and then only statistically evaluated in this form

  • We also collect and store e-mail addresses for which delivery has failed several times. So that our newsletter is not categorised as spam, we ensure that no further deliveries are made to these e-mail addresses.

  • Sending our newsletter to the e-mail address provided;

  • Personalisation of the newsletter address; 

  • Analysis of opening and click behaviour as well as information on the end device, the email software and the recipient's region to better understand the effectiveness of our approaches and to improve the effective targeting and content of our newsletter;

  • Proof of consent; and

  • Prevent our newsletter from being categorised as spam due to frequent failed deliveries.

Your consent to the sending and personalisation of the newsletter and the processing for analysis with evaluation on an anonymised basis.

You can revoke your consent in particular by using the corresponding link in a newsletter message or by sending us a declaration.

With regard to the documentation of consent and the collection and storage of e-mail addresses in the event of multiple failed deliveries: Our legitimate interest, namely in the possibility of proving your consent and preventing our newsletter messages from being classified spam due to failed e-mail deliveries.

We store your data until you unsubscribe from the newsletter or we have not sent you a newsletter for more than 17 months. If you unsubscribe from the newsletter, your data will be deleted within 7 days, with the following exceptions: 

  • Proof of consent to receive the newsletter will be kept for longer for evidence purposes, but will be deleted at the latest 3 years after unsubscribing from the newsletter.

  • We store e-mail addresses for which delivery has failed several times for up to 12 months.

You can counteract the tracking of opening and clicking behaviour using pixels by preventing the display of images in your email program. However, if you click on links contained in our newsletter, we will still find out about this.

Disclosure to third parties: 

  • Service provider for the operation of the newsletter:

Positive Group Chemnitz GmbH
Schönherrstrasse 8
09113 Chemnitz
Germany

  • Transfer within the Group: 

CA Immo Germany GmbH
Friedrich-Ebert-Anlage 35-37
60327 Frankfurt am Main
Germany.

In this context, there is joint responsibility with CA Immo Deutschland GmbH regard to the processing of data. We have contractually agreed that we will act as a central point of contact for all enquiries you may have regarding data protection. However, you can also assert your data protection rights against CA Immo Deutschland GmbH.

Transmission to third countries:

  • Your data will not be transferred to third countries.

You have the option of communicating with us via various communication channels. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

Via e-mail: 

  • E-mail address, time of the message, metadata such as IP address, content of the communication including data contained therein such as name.

Via telephone:

  • Telephone number, time of your call, content of the communication including data contained therein such as name.

Via postal communication: 

  • Surname, first name, address, date your message was sent, content of the communication including the data contained therein.

Via Webex/ video conferencing

  • Appointments, invitations for meetings, addresses for meetings;

  • Name; 

  • Date on which your message or communication was sent;

  • Contents of the communication including the data contained therein;

  • Image and sound recordings (including content transmitted via screen sharing);

  • Chat histories; 

  • Surveys; 

  • shared files that have been created; 

  • Date and time of activities (or the last activity);

  • Membership of collaborative groups (teams); 

  • Calendar entries (from Outlook), profile picture (optional), technical data such as IP address, device data (e.g. operating system; resolution; hardware).

  • Processing your enquiry to your satisfaction. We will contact you via the communication channel of your choice, by telephone or e-mail;

  • Communication with you;

  • To analyse requests in order to improve the quality of our responses and services.

Processing of your enquiry: 

If the communication takes place with regard to the initiation or execution of a contract with us: 

  • Contract or pre-contractual measures at your request, 

otherwise: 

  • Legitimate interest, namely to receive and respond to the contact request or communication.

Analysing the requests:

  • Legitimate interest, namely in analysing our communication in order to improve the quality of our responses and services.

For a maximum of 3 years after the enquiry has been dealt with, unless we are obliged to store the data for longer due to legal obligations. This is 7 years for communication relevant to commercial law and 10 years for documents relevant to tax law.

For expressions of interest in one of our projects until the end of the marketing process plus 12 months.

If you communicate with us via a video conference, please also note the specific data protection information: "Recording of video conferences", which you can access at https://www.caimmo.com/en/data-protection-declaration/data-protection-information-recording-of-video-conferences/. 

Disclosure to third parties: 

  • If this is required for fulfilment, your data may be passed on within the Group companies in individual cases.

  • In the case of postal delivery, data is passed on to the dispatch service provider for postal dispatch.

  • If sent by e-mail, data will be passed on to the e-mail provider.

  • For video conferences via Webex: 

    • Cisco Systems, Inc.
      170 West Tasman Dr.
      San Jose, CA 95134 USA

  • For communication via Microsoft Teams: 

    • Microsoft Ireland Operations Limited

      One Microsoft Place
      South County Business Park
      Leopardstown
      Dublin 18
      Ireland

  • Other communication participants, such as participants in video conferences.

Transmission to third countries:

When participating in video conferences: 

USA - Cisco Systems, Inc. is certified under the EU-US Privacy Framework. In addition, the Master Data Protection Agreement that we have concluded with Cisco contains the EU Standard Contractual Clauses and Binding Corporate Rules. Microsoft Corporation is certified under the EU-US Privacy Framework. We have also concluded the standard contractual clauses with Microsoft.

If you have a business relationship with us, we process your data for network maintenance.

Processed data

Purposes

Legal basis 

Storage duration

  • Contact details;

  • Birthday, if applicable (to congratulate);

  • Notes if applicable (summer party invitation/Christmas card list), 

  • If applicable, secretarial contact details and contact details of employees;

  • Quotes;

  • Key data on any transactions carried out jointly or the other business relationship (such as purchase prices, rented square metres); and

  • Type of co-operation.

  • Maintaining the business relationship;

  • communication in this context; and

  • maintain social contact.

If you have given us your prior consent:

  • Your consent

otherwise: 

  • Legitimate interest, namely in the purposes described.

Generally for the duration of the fulfilment of the contract or to comply with statutory retention obligations. This is 5 years for money laundering data, 7 years for communication relevant to commercial law and 10 years for documents relevant to tax law.

Data is stored until it is possible to assert legal claims arising from the business relationship with you. This is usually 4 years after the end of the respective business relationship, unless shorter or longer limitation periods are considered in exceptional cases.

Disclosure to third parties: 

  • CA Immo Group companies, insofar as they require your data to maintain the business relationship.

  • Selected business partners such as property management.

  • In special cases, e.g. for deal notifications

    • Journalists, 

    • Investors, private shareholders, analysts, 

    • Email marketing software provider, newsletter recipients

Transmission to third countries:

If deal announcements or similar are published, it cannot be ruled out that such corporate communications will be accessed from third countries.

Otherwise there will be no transfer to third countries.

From time to time we organise various events to which we may invite you, or for which you can register or otherwise participate.

We take photos and videos at some of our events. In this case, please note the specific data protection information "Photo information", which you can access at www.caimmo.com/de/fotohinweis/.

Your data may also be processed during the invitation, planning and organisation of events. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Contact details;

  • Event sub-name;

  • Number of additional guests, if applicable;

  • Invitation data (place, time, motto, etc.);

  • Consents

  • any special dietary requirements;

  • Communication and speech content; and

  • special accessibility requirements, if applicable.

  • Planning, preparation, realisation and, if necessary, follow-up of various event formats;

  • Invitation and administration of guests;

  • Consideration for individual needs; and

  • Communication and marketing of our company, our products and services.

If the communication takes place with regard to the initiation or execution of a contract with us: 

  • Contract or pre-contractual measures at your request, 

otherwise: 

  • Our legitimate interest in achieving the purposes described.

Until you actively unsubscribe from the "Events" distribution list (via unsubscribe email or direct contact/email)

Otherwise 5 years.

 

Disclosure to third parties: 

  • Other invited guests, if applicable.

  • CA Immo Group companies, insofar as they require your data for invitations to or the organisation of events.

  • External agencies.

  • Co-operation partners (to coordinate the distribution list).

  • Email marketing software provider.

  • Printer / Producer.

  • Courier services.

  • Press journalists.

Transmission to third countries:

  • Your data will not be transferred to third countries.

We may publish selected information, images, videos or quotes from people with whom we have business dealings. Such publications may be made in brochures, printed materials, on our websites or in third-party publications. In this case, we process your data as follows:

Processed data

Purposes

Legal basis 

Storage duration

Depending on the specific publication:

  • Contact details;

  • Quotes;

  • Key transaction data;

  • The nature of our co-operation;

  • Photos; and

  • Video recordings.

  • Presentation of our company and our activities to the public.

 

If we have concluded a contract with you, the purpose of which includes publication (e.g. modelling contract), 

  • Contract

or, if you have given us your consent:

  • Your consent

Otherwise:

Our legitimate interest in the presentation of our company and our activities.

According to the purpose of the publication, up to 30 years

Disclosure to third parties: 

  • The data is accessible to the interested public.

  • CA Immo Group companies, insofar as they require your data for publications.

Transmission to third countries:

If data is published, it can also be accessed from third countries or otherwise processed there. This applies in particular to publications on the Internet. 

We may carry out surveys or ask you to give us feedback. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

Processed data

  • Contact details; 

  • Consents, if applicable; and

  • Communication content and feedback.

  • Obtaining opinions and feedback in order to align our products, brands, strategies and other business practices;

  • Measuring success; and

  • Optimisation of our business practices.

  • Our legitimate interest in achieving the purposes described

or, if you have given us your consent:

  • Your consent.

5 years.

  • Contact details; 

  • Consents, if applicable; and

  • Communication content and feedback.

Disclosure to third parties: 

  • Group companies.

  • Seminar provider.

  • IT service provider (operator of the online-based survey software).

Transmission to third countries:

  • Your data will not be transferred to third countries.

 

We have presences on various social networks and actively operate them. In doing so, we may process data from people who interact with us on these networks or whose data is otherwise collected in connection with our social media channels. You can find more information on this data processing in our specific data protection information on social media , which you can access at https://www.caimmo.com/en/data-protection-declaration/data-protection-information-social-media/.

We offer our website with a range of technical functionalities to give you the opportunity to obtain comprehensive information about us, our products and our services, including career opportunities. We have summarised the associated data processing activities here. 

Some of these data processing activities use so-called cookies, pixels or similar (tracking) technologies. We explain these in more detail below under "Cookies". Please also note this information.

4.11.1. Log files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The data is not analysed for marketing purposes in this context. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • IP address of the user;

  • http method and http version;

  • Access status/status code of the server response;

  • Browser version;

  • Referrer URL (website from which you access our website);

  • User name of the visitor (if logged in via system login - if the user is logged in within a web application and this has its own user administration, the user name is not logged);

  • Date and time of the request and number of bytes sent;

  • Responses from the server; and

  • Error codes.

  • Storage of the IP address and system data by the system to enable delivery of the website to the user's computer;

  • Storage in log files to ensure the functionality of the website; and 

  • Optimisation of the website and to ensure the security of our information technology systems. 

Our legitimate interest in achieving the purposes described.

The data is either deleted at the end of the respective session, anonymised or stored in log files. If the data is stored in log files , it is deleted after 60 days.

Disclosure to third parties: 

  • CA Immo Germany GmbH
    Friedrich-Ebert-Anlage 35-37
    60327 Frankfurt/Main
    Germany.

  • Website provider / IT service provider / web agency

supseven - TYPO3 digital agency, 
Fockygasse 29-31,
1120 Vienna
Austria.

  • IT service provider

Prescreen International GmbH, 
Mariahilfer Straße 17, 
1060 Vienna, 
Austria.

  • IT service provider: 

Positive Group Chemnitz GmbH
Schönherrstrasse 8
09113 Chemnitz
Germany

Transmission to third countries:

  • Your data will not be transferred to third countries.

4.11.2. Google Maps integration

We use the map material from Google Maps to display the location of our properties. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Session ID

  • Google user ID to identify the person

  • IP address

  • Tracking profiles and movement analyses

  • Settings such as preferred language, pages visited; screen and window resolution; and

  • Further data.

  • The integration of map material from Google Maps is used for the professional presentation of the content of our website. We use this service to display the location of the property. When you use Google Maps, your data is processed. 

Purpose of data processing for Google:

  • Google also processes your data through the cookies set by Google. Google also uses this data for its own purposes, in particular to optimise its own services and to provide you with individual, personalised advertising and content. One of the ways Google achieves this is by assigning you a unique ID and assigning it to your Google account, which enables it to track which websites you visit. By allowing the Google cookie on our website, Google also learns that you have visited it

  • Your consent

You can declare and revoke your consent by ticking the corresponding box in our consent banner or subsequently when you call up the application.

 

We do not store any data permanently.

According to Google's retention policy, advertising data is anonymised in server logs by deleting part of the IP address and cookie information after 9 and 18 months respectively.

Disclosure to third parties: 

  • Google Ireland Limited,

Gordon House, 
Barrow Street, 
Dublin 4, 
Ireland.

Transmission to third countries:

Google Ireland Limited forwards your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, among others. Google LLC is certified in accordance with the "Data Privacy Framework". We have also concluded standard contractual clauses with Google LLC and only use this service with your consent

4.11.3. Integration of videos by CA Immo directly

We embed videos directly on our website. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Log data (see above);

  • Volume;

  • Playback speed; and

  • Resolution.

  • playback of videos on our website; and

  • professional presentation of the contents of our website. 

Our legitimate interest in achieving the purposes described.

The data is either deleted at the end of the respective session, anonymised or stored in log files. The latter contain the time, the IP address, the user agent (information about the web browser used) and the requested URL. This stored data is not analysed. If the data is stored in log files, it is deleted after one year at the latest.

Disclosure to third parties: 

  • CA Immo Germany GmbH
    Friedrich-Ebert-Anlage 35-37
    60327 Frankfurt/Main
    Germany.

  • Website provider / IT service provider / web agency: 

supseven - TYPO3 digital agency, 
Fockygasse 29-31,
1120 Vienna
Austria.

  • IT service provider: 

Prescreen International GmbH, 
Mariahilfer Straße 17, 
1060 Vienna, 
Austria.

  • IT service provider: 

Positive Group Chemnitz GmbH
Schönherrstrasse 8
09113 Chemnitz
Germany

Transmission to third countries:

  • Your data will not be transferred to third countries.

4.11.4. Construction site cameras

We can make video material from the operation of cameras on CA Immo construction sites available on our website, in particular to inform the interested public about the progress of construction work. The recordings from the construction site cameras are made at a coarse granularity/resolution and from a great distance, so that neither people nor vehicles are zoomed in and therefore easily identifiable. 

You can find more detailed information on this data processing in our specific data protection information on construction site cameras, which you can access at https://www.caimmo.com/en/data-protection-declaration/data-privacy-information-construction-site-cameras/.

4.11.5. Financial report order

You have the option of using a form on our website to order financial reports from CA Immo, which we will then send to you either by post or by e-mail. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Year of the requested financial report; 

  • desired language of the report (German / English); 

  • Salutation; 

  • Name; 

  • Company (optional); 

  • Address;

  • Country (optional); 

  • E-mail address; 

  • other messages via a free text field (optional); and

  • Your consent.

  • Sending of financial reports and other communication if necessary;

  • Managing the relationship with our investors as well as potential new investors and the interested public; and

  • Documentation of communication

Contract-like relationship.

Your data will be stored until it is possible to assert legal claims arising from the business relationship with you. This is usually 4 years after the end of the respective business relationship, unless shorter or longer limitation periods are considered in exceptional cases.

Disclosure to third parties: 

  • In the case of postal dispatch, the dispatch service provider for postal dispatch.

  • If sent by e-mail, the e-mail provider.

Transmission to third countries:

  • In principle, we do not transfer your data to third countries. 

4.11.6. Whistleblower system

From our website you can access our whistleblower system via a link. This is an independent website which has its own special data protection information. Please take note of this.

4.11.7. Job advertisements

On our careers page, you have the opportunity to view current vacancies and their descriptions. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Recognised job advertisements;

  • Search entries;

  • Filter settings, such as country, city, search radius, institution, jobs; and 

  • Log data (see above).

 

  • Display vacancies in an organised and searchable format; and

  • Analysing and improving our career website.

Your consent

Technical data is generally stored for a period of 12 months, unless longer storage is required by law.

Please also note the information under the processing activity "Application form".

Disclosure to third parties: 

  • New Work SE, 
    Am Strandkai 1,
    20457 Hamburg, 
    Germany

In this context, there is joint responsibility with New Work SE with regard to the processing of data. We have contractually agreed that we are available as a central point of contact for all enquiries you may have regarding data protection. However, you can also assert your data protection rights against New Work SE.

Transmission to third countries:

  • In principle, we do not transfer your data to third countries. 

4.11.8. Application form

We have created specific applicant data protection information on data processing during the application process, which you can find on the careers page and at https://www.caimmo.com/en/data-protection-declaration/application-procedure/.

4.11.9. Web analysis

We analyse the use of our website with the web analysis service Matomo. In this case, we process your data as follows: 

Processed data

Purposes

Legal basis 

Storage duration

  • Session ID; 

  • User ID; 

  • E-mail address; 

  • IP address (the last two digits are removed); 

  • approximate location (based on the IP address); 

  • last visited website; 

  • Operating system or device type/model/resolution/brand; 

  • local time

  • Language settings; website content / reactions; and 

  • other necessary data.

  • Collecting information about the use of the website to improve the user-friendliness of our website, analysing user data in order to get to know the preferences of our website visitors and to be able to better personalise our offer.

Your consent.

  • The data obtained from the analysis is stored for a period of two years.

Disclosure to third parties: 

  • Group companies if they require access to your data.

  • Matomo Cloud, operated by 

    ePrivacy Holding GmbH, 
    Große Bleichen 21, 
    20354 Hamburg, 
    Germany.

Transmission to third countries:

For the purpose of operating Matomo, it uses Amazon Web Services Inc. ("AWS"), 410 Terry Avenue North, Seattle WA 98109, USA. All data is processed by AWS in Frankfurt, Germany. Backups are stored in Dublin, Ireland. It is contractually agreed that the data may not be transported outside the EU. Nevertheless, we cannot rule out the possibility that AWS may transfer your data to the USA due to its headquarters in the USA. ePrivacy Holding GmbH has concluded standard contractual clauses with Amazon Web Services Inc. Amazon Web Services, Inc. is also certified in accordance with the "Data Privacy Framework".

The CA Immo websites use cookies, pixels and similar tracking technologies ("cookies"), which we explain below.

Cookies are small text files or pieces of code that are stored on your end device (e.g. PC/laptop, tablet or smartphone). These text files are initially downloaded from your browser on our website. This can happen on your first visit to our website or later, for example when you change your cookie settings or during a new browsing session. When this website is called up again with the same end device or browser, the cookie and the information stored in it is either sent back to the respective website that generated it (first party cookie) or sent to another address to which it belongs (third party cookie). The recipient then receives the information stored in this way. For example, a website can "recognise" that it is the same user and adapts the display of website content accordingly. Cookies therefore "remember" your preferences, communicate how you use a page and customise the offers displayed in some cases

We also include other tracking technologies under the term "cookie". For example, it is possible to identify you based on your "digital fingerprint", i.e. the combination of technical data, the device used, the location from which you accessed the website, etc. It is also possible, for example, to incorporate so-called pixels into the website in order to track you. In fact, however, these technologies serve similar purposes, so they are dealt with together below.

Depending on the specific purpose, a further distinction is made between the different types of cookies.

We use several essential cookies on our website. When using essential cookies, we process your data in order to be able to provide basic functions of our website and the services you have requested, as well as to temporarily save your cookie settings. Without the use of these cookies, we would not be able to provide the website or there would be functional restrictions.
 

We use several non-functional cookies on our website. These cookies are not functionally necessary for the operation of our website and include, for example, cookies to analyse user behaviour on websites, cookies to enable a better user experience by integrating videos or maps from other websites or cookies to show you advertising.

You can find more information on the cookies we use, the processing purposes, the data types, the legal basis and the storage period and recipients under "Cookie settings". You can access these via the cookie banner or the tab at the bottom of the website.

As a data subject, you have the following rights in relation to the processing of your data:

Right to withdraw consent

If we process your data on the basis of your consent, you are entitled to withdraw your consent at any time. After receiving your cancellation, we will no longer process this data. However, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to information

You can request information about the data processed about you, in particular about the origin and categories of data processed, the storage period, the recipients to whom your data has been disclosed, the purpose and type of processing. On request, we will provide you with a copy of the data that we process about you.

We would like to point out that no information is to be provided if this would jeopardise the business or trade secrets of the controller or third parties.

Right to rectification

If we process data about you that is incorrect or incomplete, you can request that it be corrected or completed - also by means of a supplementary declaration.

Right to cancellation

You have the right to demand that we erase the data concerning you. 

We would like to point out that the right to erasure does not exist in particular if we have to process the data in order to fulfil a legal obligation or to be able to assert, exercise or defend legal claims.

Right to restriction of processing

You have the right to request that we restrict the processing of your data, for example if you dispute the accuracy of the data, for a period of time that enables us to verify the accuracy of this data.

Right to data portability

If we process data about you that you have provided to us, you may, under certain circumstances, request that this data be transmitted to you in a machine-readable format. You can also instruct us to transmit this data directly to a third party of your choice, provided this is technically feasible. 

Right to lodge a complaint

Although we endeavour to ensure the protection and integrity of your data to the best of our ability, disagreements about the way in which we use your data cannot be ruled out. You therefore have the right to lodge a complaint with a data protection authority. This could include the data protection authority at your place of residence or at our location. 

The data protection authority responsible for us is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, telephone: +43 1 52 152-0, e-mail: dsb@dsb.gv.at. However, we encourage you to contact us first if you have any questions or concerns about our processing of your data so that we can find a solution together.

RIGHT TO OBJECT

Even if your personal data is correct and complete and is processed by us lawfully, you can object to the processing of this data at any time if there are special reasons relating to your person. You can also object at any time if you receive direct advertising from us and no longer wish to receive this in future.

The Websites may contain integrations or links to third-party websites or services, including those of our business partners. When you interact with these third parties, you are submitting information directly to the third party and not to CA Immo. Please note that CA Immo is not responsible for the privacy practices of these third parties or any other companies that it does not own or control. We encourage you to read the privacy policies and online terms and conditions of these third parties to learn more about how they handle your data.

We reserve the right to amend this data protection information from time to time at our own discretion. We will notify you of any material changes in the way we handle data by informing you in an appropriate manner through a prominent notice on our website or through other appropriate communication channels. Please check this data protection information at regular intervals. All changes will take effect from the date of publication, unless otherwise stated.

For all your data protection concerns, in particular to assert your rights, please contact us in writing (by letter or e-mail) at the address given above under "Controller and Data Protection Officer". Alternatively, you can also our data protection officer directly (service@dsgvoschutzteam.com).

List of CA Immo Group companies with access to data

CA Immo Deutschland GmbH
Friedrich-Ebert-Anlage 35-37
60327 Frankfurt/Main
Germany

Mainzer Hafen GmbH
Rheinallee 41,
55118 Mainz
Germany

CA Immo Real Estate Management Hungary Kft
Rákóczi út 70,
1074 Budapest,
Hungary

CA Immo Real Estate Management Poland Sp.z.o.o
SIENNA 39,
00-121 Warsaw,
Poland

CA Immo Real Estate Management Czech Republic s.r.o
Karolinská 650,  
186 00 Prague 8-Karlín,
Czech Republic

CA Immo BIP Liegenschaftsverwaltung GmbH
Mechelgasse 1
1030 Vienna,
Austria

CA Immo Galleria Liegenschaftsverwaltung GmbH
Mechelgasse 1
1030 Vienna,
Austria

CA Immo Konzernfinanzierungs GmbH
Mechelgasse 1
1030 Vienna,
Austria

DRG Deutsche Realitäten GmbH
Friedrich-Ebert-Anlage 35-37
60327 Frankfurt/Main
Germany

Key contents of the joint responsibility agreement Between us and CA Immo Deutschland GmbH 

CA Immo and CA Immo Deutschland GmbH have concluded a contract within the meaning of Art. 26 GDPR to regulate your rights and obligations with regard to joint data processing by the parties ("joint controllership agreement"). 

This joint responsibility relates to the processing of data in the course of offering the newsletter, as described above. This is offered by our Corporate Communications department, which operates across both companies.

In the aforementioned agreement, the parties have defined their so-called areas of activity with regard to joint data processing. These areas of activity each describe the responsibilities of the parties. 

  • Our area of activity primarily comprises newsletters from the CA Immo Group website and from such websites, and on topics relating to CA Immo Anlagen Aktiengesellschaft and the activities of CA Immo in Austria.

  • The sphere of activity of CA Immo Deutschland GmbH primarily comprises websites and other projects relating to the activities of the CA Immo Group in Germany. 

If one of the parties commissions service providers in its area of responsibility, this contractual relationship, including the data processing carried out in this context, falls within the scope of this party.

We have contractually agreed that we are available as a central point of contact for all enquiries you may have regarding data protection. 

However, you can also assert your data protection rights against CA Immo Deutschland GmbH.

If you would like more information on the essential content of the joint responsibility agreement, please contact 

CA Immobilien Anlagen Aktiengesellschaft
Mechelgasse 1
1030 Vienna, Austria
Phone: +43/1/532 59 07

CA Immo Deutschland GmbH,
Friedrich-Ebert-Anlage 35-37, 
60327 Frankfurt/Main, Germany
Phone: +49/69/60 627 0