Information on data protection

This privacy notice explains how we handle your personal data and sets out your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The data controller is the KAIFU-NORDLAND eG housing cooperative (hereinafter referred to as ‘we’ or ‘us’).

I. General Information

1. Contact

If you have any questions or suggestions regarding this information, or if you wish to contact us to exercise your rights, please direct your enquiry to

KAIFU-NORDLAND eG
Housing Cooperative Kieler Straße 131
22769 Hamburg
Tel.: 040 / 43 17 02 - 0
Email: info@kaifu.de

2. Legal Basis

The data protection term ‘personal data’ refers to all information relating to an identified or identifiable individual. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. We process data only on the basis of a legal authorisation. We process personal data only with your consent (Section 25(1) of the TDDDG or Article 6(1)(a) of the GDPR), to fulfil a contract to which you are a party, or in response to your request to take pre-contractual measures (Article 6(1)(b) of the GDPR), to comply with a legal obligation (Article 6(1)(c) of the GDPR) or where processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights and freedoms, which require the protection of personal data, do not override those interests (Article 6(1)(f) of the GDPR).

If you apply for a vacancy within our company, we also process your personal data for the purpose of deciding whether to enter into an employment relationship (Section 26(1), first sentence, of the German Federal Data Protection Act (BDSG)).

3. Duration of storage

Unless otherwise stated in the following information, we will only retain the data for as long as is necessary to fulfil the purpose of processing or to meet our contractual or legal obligations. Such statutory retention obligations may arise, in particular, from commercial or tax law provisions. From the end of the calendar year in which the data was collected, we will retain personal data contained in our accounting records for ten years and personal data contained in commercial correspondence and contracts for six years. Furthermore, we will retain data relating to consents for which proof is required, as well as to complaints and claims, for the duration of the statutory limitation periods. We will delete data stored for marketing purposes if you object to its processing for this purpose.

4. Categories of data recipients

We use data processors in connection with the processing of your data. The processing operations carried out by such data processors include, for example, hosting, sending emails, maintenance and support of IT systems, customer and order management, order processing, bookkeeping and invoicing, marketing activities, and the destruction of files and data storage media. A data processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller. Data processors do not use the data for their own purposes, but carry out data processing exclusively on behalf of the data controller and are contractually obliged to ensure appropriate technical and organisational measures for data protection. In addition, we may transfer your personal data to bodies such as postal and courier services, our principal bank, tax consultancy/audit firms or the tax authorities. Further recipients may be identified in the following information.

5. Data transfers to third countries

Our data processing activities may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR is not applicable. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is ensured in that third country. If no such adequacy decision has been issued by the European Commission, the transfer of personal data to a third country will only take place if suitable safeguards are in place in accordance with Article 46 of the GDPR or if one of the conditions set out in Article 49 of the GDPR is met.

In the absence of an adequacy decision and unless otherwise stated below, we use the EU Standard Data Protection Clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option of obtaining a copy of these EU Standard Data Protection Clauses or viewing them. To do so, please contact us at the address provided under ‘Contact’.

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Article 49(1)(a) of the GDPR.

6. Processing in connection with the exercise of your rights

When you exercise your rights under Articles 15 to 22 of the GDPR, we process the personal data provided for the purpose of implementing these rights and to be able to provide evidence thereof. We will process data stored for the purpose of providing information and preparing such information solely for this purpose and for the purposes of data protection monitoring; otherwise, we will restrict processing in accordance with Article 18 of the GDPR.

This processing is based on the legal basis of Article 6(1)(c) of the GDPR in conjunction with Articles 15 to 22 of the GDPR and Section 34(2) of the BDSG.

7. Your rights

As a data subject, you have the right to exercise your data subject rights vis-à-vis us. In particular, you have the following rights:

  • In accordance with Article 15 of the GDPR and Section 34 of the BDSG, you have the right to request information as to whether, and if so to what extent, we process personal data relating to you.
  • You have the right, in accordance with Article 16 of the GDPR, to request that we rectify your data.
  • You have the right, in accordance with Article 17 of the GDPR and Section 35 of the BDSG, to request that we erase your personal data.
  • You have the right, in accordance with Article 18 of the GDPR, to have the processing of your personal data restricted.
  • You have the right, in accordance with Article 20 of the GDPR, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit this data to another controller.
  • If you have given us separate consent to the processing of your data, you may withdraw this consent at any time in accordance with Article 7(3) of the GDPR. Such a withdrawal does not affect the lawfulness of processing carried out on the basis of consent prior to the withdrawal.
  • If you believe that the processing of your personal data infringes the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR.

8. Right to object

In accordance with Article 21(1) of the GDPR, you have the right to object to processing carried out on the legal basis of Article 6(1)(e) or (f) of the GDPR on grounds relating to your particular situation. Where we process your personal data for the purposes of direct marketing, you may object to such processing in accordance with Article 21(2) and (3) of the GDPR.

9. Data Protection Officer

You can contact our Data Protection Officer using the following details:

Email: olivier@vnw.de

Association of North German Housing Companies e.V.

Tangstedter Landstraße 73, 22415 Hamburg

https://www.vnw.de

II. Data processing on our website

When you use the website, we collect information that you provide yourself. In addition, during your visit to the website, we automatically collect certain information about your use of the website. Under data protection law, an IP address is generally also considered to be personal data. An IP address is assigned to every device connected to the internet by the internet service provider so that it can send and receive data.

1. Processing of server log files

When you use our website purely for information purposes, general information transmitted by your browser to our server is initially stored automatically (i.e. not via registration). By default, this includes: browser type/version, operating system used, page accessed, the previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code.

This processing is carried out to safeguard our legitimate interests and is based on the legal basis of Article 6(1)(f) of the GDPR. This processing serves the purposes of technical administration and the security of the website. The stored data is deleted after 60 days, unless there are specific grounds for a legitimate suspicion of unlawful use and further examination and processing of the information is therefore necessary. We are unable to identify you as a data subject on the basis of the stored information. Articles 15 to 22 of the GDPR therefore do not apply in accordance with Article 11(2) of the GDPR, unless you provide additional information enabling your identification in order to exercise your rights set out in these articles.

2. Registration

Registration is required to use the tenant portal or the ‘Meine KAIFU’ app. In doing so, we process, in particular, the registration code, your email address, the login details you have specified, the membership, contract or user ID assigned to your account, as well as technical log and security data.

The purpose of this processing is to verify your access authorisation, to set up and manage your user account, to authenticate you during subsequent log-ins, and to prevent unauthorised access. The legal basis is Article 6(1)(b) of the GDPR. Insofar as the processing serves to ensure IT security and to prevent unauthorised access, it is additionally based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure operation of the portal and the app.

The data marked as mandatory is required for registration. Without this information, we cannot set up the user account. Account data is generally stored for the duration of the user’s authorisation to use the service and is subsequently deleted or blocked, provided there are no statutory retention obligations or legitimate grounds for further storage.

Further information on the processing of your data in the tenant portal and in the app can be found in Section IV.1.

3. Marketing of flats via wohnungshelden

We use the ‘wohnungshelden’ application for the digital marketing of our flats. The application enables us to publish property listings, receive expressions of interest and enquiries, coordinate viewing appointments, and process details for the further handling of prospective tenants.

In the course of using the application, the following data in particular may be processed:

  • Personal and contact details, in particular name, address, email address and telephone number,
  • details of the desired rental property and personal search criteria,
  • The content of enquiries and other communications,
  • Details regarding the arrangement and conduct of viewings,
  • where applicable, further details and documents which prospective tenants themselves provide as part of the letting process.

The processing is carried out for the purpose of publishing property listings, processing enquiries from prospective tenants, coordinating further communication and, where applicable, viewing appointments, and preparing for the conclusion of a tenancy agreement. Insofar as the processing is necessary for the implementation of pre-contractual measures at the data subject’s request, it is carried out on the basis of Article 6(1)(b) of the GDPR. Where the system is used for the efficient organisation and execution of property marketing, processing is additionally carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

We generally store the data collected in connection with property marketing only for as long as is necessary to process the enquiry, carry out the letting process, or prepare for or execute a tenancy agreement. Furthermore, we only store the data where statutory retention obligations apply or where storage is necessary for the establishment, exercise or defence of legal claims.

To protect the enquiry form from misuse by automated programmes, the wohnungshelden form uses the Google reCAPTCHA service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA uses characteristics such as IP address, browser and device information, the date and time of the request, and user behaviour on the page to verify whether an entry has been made by a human. It cannot be ruled out that data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in protecting the form from spam and malicious enquiries. Further information can be found at https://policies.google.com/privacy.

4. Job applications

You have the option to apply for a job via the ‘Jobs’ section of our website. To this end, we collect personal data from you, including, in particular, your name, CV, cover letter and any other content you provide. For the selection of applications, we use the service provider softgarden, softgarden e-recruiting GmbH, Berlin, Germany, as a data processor.

Your personal application data will be processed exclusively for purposes relating to your interest in current or future employment with us and the processing of your application. Your application will only be processed and reviewed by the relevant contacts within our organisation. In connection with your application, we process in particular:

  • Personal and contact details;
  • Details of your qualifications and professional background;
  • CV and cover letter;
  • Certificates and other documents provided by you;
  • Communication and interview content;
  • where applicable, any further information required for the application process.

Data processing is carried out for the purpose of deciding whether to enter into an employment relationship, in accordance with Section 26(1) of the Federal Data Protection Act (BDSG).

All staff entrusted with data processing are obliged to maintain the confidentiality of your data. Should we be unable to offer you employment, we will retain the data you have provided for up to six months after the conclusion of the application process for the purpose of answering any queries relating to your application and rejection. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purposes of providing evidence, or if you have expressly consented to longer storage.

Should we retain your application data for longer than six months and you have expressly consented to this, please note that this consent may be freely withdrawn at any time in accordance with Article 7(3) of the GDPR. Such a withdrawal does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal.

5. Newsletter

On our website, we offer the option to subscribe to our newsletter. Once you have subscribed, we will keep you regularly informed about the latest news regarding our services. A valid email address is required to subscribe to the newsletter. To verify your email address, you will first receive a registration email which you must confirm via a link (double opt-in). When you subscribe to the newsletter on our website, we process personal data such as your email address on the basis of the consent you have given. This processing is based on the legal basis set out in Article 6(1)(a) of the GDPR. You may withdraw the consent you have given at any time with future effect, for example via the ‘Unsubscribe’ link in the newsletter. The lawfulness of any data processing operations that have already taken place remains unaffected by the withdrawal.

When you subscribe to the newsletter, we also store your IP address and the date and time of your subscription. The processing of this data is necessary to be able to provide evidence of the consent given. The legal basis stems from our legal obligation to document your consent (Article 6(1)(c) in conjunction with Article 7(1) of the GDPR).

We use CleverReach GmbH & Co. KG, Rastede, Germany, as a data processor for the administration of subscriptions, the dispatch of the newsletter and the analysis of newsletter usage.

Provided you give your separate consent for this, we may record whether and when a newsletter has been opened and which links contained therein have been clicked. For this purpose, tracking pixels, personalised links and similar technologies may be used. The purpose of this analysis is to measure the usage and success of our newsletters and to better tailor content to the interests of our recipients. The legal basis is Article 6(1)(a) of the GDPR. Without such consent, no personal analysis of your opening or clicking behaviour will take place. Irrespective of this, we may analyse fully anonymised delivery statistics that cannot be traced back to individual recipients.

You may withdraw your consent at any time with future effect, in particular via the unsubscribe link in each newsletter or via the contact details provided under ‘Contact’. Once you have unsubscribed, we will remove your data from the active mailing list. We store your email address on a block list to ensure that you do not receive any further newsletters. This storage is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in complying with your withdrawal of consent and in preventing unsolicited communications.

Please note the information in the section ‘Data transfers to third countries’.

6. Cookies

We use cookies and similar technologies (“cookies”) on our website. Cookies are small data files that are stored by your browser when you visit a website. This identifies the browser being used and allows it to be recognised by web servers. You have full control over the use of cookies via your browser. You can delete cookies at any time via your browser’s security settings. You can object to the use of cookies via your browser settings, either generally or in specific cases.

The use of cookies is, in part, technically necessary for the operation of our website and is therefore permitted without the user’s consent. In addition, we may use cookies to offer specific functions and content, as well as for analytical and marketing purposes. These may also include third-party cookies. We only use such cookies that are not technically necessary with your consent in accordance with Section 25(1) of the TDDDG and, where applicable, Article 6(1)(a) of the GDPR. Information on the purposes, providers, technologies used, data stored and the retention period of individual cookies can be found in the cookie settings of our Consent Management Tool. You can access these at any time via the ‘Change cookie settings’ link in the ‘Consent Management Tool’ section.

This website uses the Cookiebot Consent Management Tool provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, to manage cookies and the processing of personal data.

The consent banner enables users of our website to give their consent to specific data processing activities or to withdraw consent that has already been given. By clicking the ‘Allow all’ button or by saving individual cookie settings, you consent to the use of the associated cookies.

The legal basis under data protection law is your consent within the meaning of Article 6(1)(a) of the GDPR.

Furthermore, the banner helps us to provide evidence of the declaration of consent. To this end, we process information regarding the declaration of consent and further log data relating to this declaration. Cookies are also used to collect this data. The processing of this data is necessary in order to be able to provide evidence of consent that has been given. The legal basis stems from our legal obligation to document your consent (Article 6(1)(c) in conjunction with Article 7(1) of the GDPR).

You can change your cookie settings or withdraw your consent with future effect here: Change cookie settings | Withdraw consent

8. Tracking & Retargeting

We use the Google Analytics 4 service on our website, provided by Google Ireland Limited, Ireland.

Google Analytics is a web analytics service that enables us to collect and analyse data on user behaviour on our website. Google Analytics allows us to measure interaction data from different devices and across different sessions. This enables us to contextualise individual user actions and analyse long-term relationships.

To this end, Google Analytics uses cookies that enable an analysis of how our website is used. In addition, personal data in the form of IP addresses, device identifiers and information about interactions with our website is processed. Some of this data consists of information stored on the device you are using. Furthermore, the cookies used also store additional information on the device you are using.

Google Ireland will process the data collected in this way on our behalf in order to evaluate how users use our website, to compile reports on activity within our website and to provide us with further services relating to the use of our website and internet usage. In doing so, pseudonymous user profiles may be created from the processed data.

The storage of information on your device and access to information already stored take place with your consent in accordance with Section 25(1) of the TDDDG. The further processing of personal data described here also takes place with your consent. The legal basis for this is Article 6(1)(a) of the GDPR. You may withdraw this consent at any time via our Consent Management Tool, with effect for the future.

When data is collected in Google Analytics 4, the IP addresses of users in the European Union are neither logged nor stored. The IP address is used on servers in the European Union to derive location data and is subsequently deleted before the remaining data is forwarded to Analytics servers for further processing.

Event data is stored for a period of 2 months, and user data for a period of 14 months, after which it is automatically deleted. The retention period for user data resets with each new activity by the relevant user. Data whose retention period has expired is automatically deleted once a month. The retention setting does not affect standard aggregated reports.

9. OpenStreetMap

On our website, we use map tiles from the OpenStreetMap (OSM) mapping service, which are provided by the OpenStreetMap Foundation (OSMF), Cambridge, United Kingdom.

When you visit a page containing an embedded map or actively load the map, your browser establishes a connection with the OSMF. In particular, the IP address required for the connection, as well as technical request and connection data, are processed. Depending on the transmission route, this may include, for example, details of the time of access, the map tile requested, the browser or device used, and the referring page. Without processing the IP address, it is technically impossible to transmit the map content to your browser.

Processing is carried out on the basis of Article 6(1)(f) of the GDPR, provided that the necessary balancing of interests favours the integration of the map. Our legitimate interest lies in providing an interactive map for displaying locations and for navigation purposes.

When using the map tiles, personal data may be processed via servers in the United Kingdom and other countries. For the United Kingdom, we base the data transfer on the applicable adequacy decision of the European Commission pursuant to Article 45 of the GDPR.

Further information on data processing can be found in the OpenStreetMap Foundation’s privacy policy at https://osmfoundation.org/wiki/Privacy_Policy.

10. Monotype

We use web fonts from Monotype Imaging Holdings Inc., USA (‘Monotype’) on our website to ensure consistent font display. When you visit a page, your browser downloads the required web fonts from our web server into your browser cache to display text and fonts correctly. For licensing reasons, it is necessary to count page views; therefore, your browser establishes a connection to fonts.com or fast.fonts.net and transmits the website operator’s client ID. This data processing is carried out to safeguard our legitimate interests in ensuring a consistent and attractive presentation of our website and is based on the legal basis of Article 6(1)(f) of the GDPR.

No cookies are set in the process. You may object to this data processing at any time via the settings of your browser or certain browser extensions. One such extension is, for example, the matrix-based firewall uMatrix for the Firefox and Google Chrome browsers. Please note that this may result in functional limitations on the website. If your browser does not support web fonts, a standard font from your computer will be used.

Further information on this processing activity, the technologies used, the data stored and the retention period can be found in Monotype’s privacy policy at https://www.monotype.com/de/rechtshinweise/datenschutzrichtlinie/datenschutzrichtlinie-zum-tracking-von-webschriften.

Please also note the information in the section ‘Data transfers to third countries’.

11. Automatic translations via the DeepL API

To provide multilingual content on our website and to translate texts in the associated backend, we use the DeepL API provided by DeepL SE, Cologne, Germany.

Via the API, the content intended for translation is transmitted to DeepL and automatically translated into the selected target language. In particular, the following data may be processed:

  • text content submitted for translation;
  • details of the source and target languages;
  • technical request and usage data, insofar as this is necessary for the provision, security and billing of the API.

The processing serves to provide and maintain multilingual website content, as well as for the technical and editorial processing of content. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in making our information and digital services available in several languages and maintaining them efficiently.

We use DeepL API Pro. The texts and translations submitted are not used to train the translation models. The texts and translations submitted are stored by DeepL only for as long as is necessary to generate and transmit the translation, and are subsequently deleted.

Where personal data is processed outside the European Union or the European Economic Area, the provisions under ‘Data transfers to third countries’ apply.

12. Use of Eye-Able

To improve digital accessibility, we use ‘Eye-Able’ on our website, a service provided by Web Inclusion GmbH, Würzburg, Germany. Eye-Able enables you to customise the display and operation of the website to suit your personal needs, for example with regard to contrast, font size, colour display, reading functions and other features designed to ensure accessible use.

The files required to provide the service, in particular JavaScript, CSS and image files, are loaded from the provider’s infrastructure. In doing so, technically necessary connection data such as IP address, time of access, requested resource, and browser and device information may be processed.

When you use Eye-Able functions, the settings you have selected are stored in your browser’s local storage so that they can be applied when you visit the page again. This local storage is necessary for the customisation function you have expressly requested and is carried out on the basis of Section 25(2)(2) of the TDDDG. According to the information available to us, the stored settings remain on your device and are not transmitted to the provider. Eye-Able does not use cookies for these settings.

Connection data is processed on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring that our online service is as accessible, user-friendly and free of barriers as possible.

Further information can be found at https://eye-able.com/de/datenschutz-eye-able/.

III. Data processing on our social media pages

We maintain a company page on several social media platforms. Through these, we aim to provide further opportunities to learn about our company and to engage with others. Our company has company pages on the following social media platforms:

  • LinkedIn, operated by LinkedIn Ireland Unlimited Company (Ireland, EU), hereinafter referred to as “LinkedIn”;
  • XING, operated by NEW WORK SE (Germany, EU), hereinafter referred to as “XING”;
  • YouTube, operated by Google Ireland Limited (Ireland, EU), hereinafter referred to as “YouTube”;
  • kununu, operated by New Work SE (Germany, EU), hereinafter referred to as “kununu”.

When you visit or interact with a profile on a social media platform, your personal data may be processed. The information associated with a social media profile you use also regularly constitutes personal data. This includes messages and statements made whilst using the profile. Furthermore, when you visit a social media profile, certain information about this visit is often collected automatically, which may also constitute personal data.

1. Visiting a social media page

When you visit our social media page, through which we present our company or individual products from our range, certain information about you is processed. The operators of the social media platforms are solely responsible for this processing of personal data. Further information on the processing of personal data can be found in their privacy policies, to which we provide links below:

The operators of the social media platforms collect and process event data and profile data, and provide us with statistics and insights for our pages in anonymised form, which help us to gain an understanding of the types of actions that people take on our page (so-called ‘Page Insights’). These Page Insights are generated on the basis of specific information about people who have visited our site. This processing of personal data is carried out by the social media operators and us as joint controllers. The processing serves our legitimate interest in analysing the types of actions carried out on our site and improving our site based on these insights. The legal basis for this processing is Article 6(1)(f) of the GDPR.

We cannot link the information obtained via Page Insights to individual user profiles that interact with our pages. Where there is joint responsibility between us and the respective platform operator for the creation and provision of usage statistics, corresponding agreements have been concluded in accordance with Article 26 of the GDPR. Further information on this can be found at:

You also have the option of exercising your rights vis-à-vis the operators. Further information on this can be found via the following links:

We have agreed with LinkedIn that the Irish Data Protection Commission is the lead supervisory authority responsible for monitoring the processing of Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or with any other supervisory authority.

2. Communication via social media pages

We also process information that you have provided to us via our company page on the relevant social media platform. Such information may include the username used, contact details or a message sent to us. We carry out this processing as the sole data controller. We process this data on the basis of our legitimate interest in contacting enquirers. The legal basis for the data processing is Article 6(1)(f) of the GDPR. Further data processing may take place if you have given your consent (Article 6(1)(a) of the GDPR) or if this is necessary to fulfil a legal obligation (Article 6(1)(c) of the GDPR).

IV. Further data processing

1. My KAIFU Tenant Portal and ‘My KAIFU’ app

a) Provision of the tenant portal and the app

We make the tenant portal and the ‘Meine KAIFU’ app available to our members and tenants. Through these services, you can, in particular, manage your user account, view and update your personal details, membership details, contract details and property information, access documents, and submit service requests and damage reports.

The app provides the functions of the tenant portal in a format optimised for mobile devices. To this end, the web platform is displayed within the app. When using the app, the following data in particular may be processed:

  • Personal and contact details;
  • Membership, user and account details;
  • Contract, tenancy and property details;
  • Billing and payment information, insofar as this is made available on the portal;
  • Documents and document access;
  • Communication and content data;
  • Details of service enquiries and claims;
  • Technical device, connection, log and security data.

Processing is carried out for the purpose of providing digital services and for the administration and management of the membership and tenancy agreement on the basis of Article 6(1)(b) of the GDPR. Ensuring stability and IT security is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and trouble-free operation of our digital services.

b) Master, contract and property data, as well as documents

In the tenant portal and in the app, we provide you with the information stored in relation to your membership or tenancy. This may include, in particular, personal and contact details, membership and contract details, information on rental properties, billing and payment information, as well as notifications and documents. Where relevant functions are available, you can check or update certain details, or submit requests for changes to us.

The processing is carried out for the purpose of administering the membership and tenancy on the basis of Article 6(1)(b) of the GDPR.

The data will be stored for the duration of the membership or tenancy and subsequently in accordance with the statutory retention and limitation periods.

c) Service enquiries and damage reports

You can submit service requests, damage reports and other enquiries via the tenant portal and the app. In doing so, we process, in particular, your contact and account details, information regarding the tenancy and the property concerned, the content of your message, and, where applicable, any photographs, documents and other attachments you provide.

The data is processed for the purpose of receiving, reviewing and handling the enquiry, as well as for communicating the status of its processing. To the extent necessary for processing, the data may be transferred to relevant staff members as well as to contracted tradespeople, repair firms, administrative bodies or other service providers.

Where the enquiry relates to an existing membership or tenancy agreement, processing is carried out on the basis of Article 6(1)(b) of the GDPR. In other cases, it is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in handling enquiries addressed to us, as well as in documenting and rectifying reported damage.

The data will be stored for the duration of the processing. It will then be deleted or transferred to the records relating to the tenancy, insofar as this is necessary for the performance of the contract, the fulfilment of legal obligations or the establishment, exercise or defence of legal claims.

Please ensure that photographs and documents show only the information necessary for processing and, where possible, do not contain any uninvolved persons or unnecessary confidential information.

d) Camera and access to files

If you wish to take a photo via the app or select an existing file or document, the app requires access to the camera or to the files you have selected. Access is granted only if you call up the relevant function and grant the necessary device permission. You can change or revoke permissions at any time in your device’s settings.

Photos and files taken or selected are only processed to the extent that you actively attach them to a service request, claims report or other communication. Further processing depends on the purpose for which the data was transmitted and is generally carried out on the basis of Article 6(1)(b) of the GDPR.

To display or share documents, files may be temporarily stored in the app’s cache directory. These files are removed by the operating system in accordance with its storage management policy. If you share a file using your device’s ‘Share’ function, you yourself determine the recipient or the service used for this purpose. Any further processing by the service you have selected is governed by that service’s privacy policy.

e) Biometric login and local secure storage

If you enable this feature, you can use the biometric authentication set up on your device, such as Face ID or a fingerprint sensor, to log in. The verification of biometric characteristics is carried out exclusively by the operating system or the security functions of your device. We do not have access to your biometric reference data and do not store it.

To enable simplified login, the authentication information required for this purpose may be stored in encrypted form in the secure storage area of your device. This feature is optional and can be disabled via the app or device settings. The processing is carried out to provide the simplified and secure login you have requested and is based on Article 6(1)(b) of the GDPR.

f) Email and push notifications

In connection with the tenant portal and the app, we may send you transactional email notifications, for example regarding your user account, the provision of new documents, the processing status of a request you have submitted, or security-related matters. For this purpose, we process, in particular, your email address, its association with your user account, the reason for and time of the message, as well as technical sending and delivery information.

This processing is carried out for the purpose of providing and operating the tenant portal you use, as well as for the administration of your membership or tenancy, on the basis of Article 6(1)(b) of the GDPR. Where messages serve to ensure the security of the user account or our digital services, the processing is additionally based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in protecting user accounts and ensuring secure communication regarding relevant matters.

The dispatch and verification data will be deleted once they are no longer required for delivery, troubleshooting or the documentation of the underlying process. Where a message forms part of a contract- or service-related process, it may be stored in accordance with the applicable retention and limitation periods.

If you enable push notifications, we may display information relating to the tenant portal, your user account and the matters being processed there on your device. For this purpose, a push token associated with the app installation or the device is processed. In addition, technical delivery and status information may be processed.

Delivery takes place via the push infrastructure of the operating system or device provider. In doing so, technical identifiers and delivery information may be transmitted to the relevant technical providers involved.

Push notifications are only sent if you have granted the relevant device permission. Insofar as the notifications relate to voluntary information, the processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. Where they are directly necessary for the operation of the tenant portal you are using or for providing information regarding an enquiry you have submitted, the processing is based on Article 6(1)(b) of the GDPR. Security-related technical processing operations may additionally be based on Article 6(1)(f) of the GDPR.

You may change or withdraw your consent at any time via the settings on your device. In this case, you will no longer receive push notifications. You will generally still be able to use the app for other purposes. The push token is deleted or deactivated when it is no longer required for delivery, in particular upon termination of the authorisation to use the app or as soon as we become aware that the token is no longer valid.

g) Technical app data

When the app is in use, technical connection, device, log and security data may be processed. This may include, in particular, the IP address, operating system and operating system version, app version, time and type of access, as well as technical error and event data.

The processing serves to provide the app, ensure compatibility with the end device, troubleshoot issues, and guarantee stability and IT security. The legal basis is Article 6(1)(b) of the GDPR and, insofar as the processing serves the purposes of security and stability, Article 6(1)(f) of the GDPR. The data will be deleted when it is no longer required for these purposes and there are no legal or security-related grounds for further storage.

h) Authentication and security cookies

We use technically necessary cookies and similar technologies for authentication, managing the logged-in session and protecting the tenant portal from unauthorised access. These include, in particular:

  • KEYCLOAK_SESSION to maintain the logged-in session;
  • KEYCLOAK_IDENTITY to map the authenticated session;
  • KEYCLOAK_AUTH_SESSION_ID to carry out the login process;
  • KC_RESTART to resume an interrupted login process;
  • Session and challenge technologies of the Web Application Firewall (WAF) to detect and block automated, malicious or harmful access attempts.

These technologies contain technically generated identifiers and are, as a rule, used only for the respective browser or application session, or for the brief period required to carry out the security check. Details of the specific technologies used and their durations can be found in the cookie overview on the tenant portal.

The storage of, or access to, the end device takes place in accordance with Section 25(2)(2) of the TDDDG, as the technologies are absolutely necessary for the expressly requested login and portal service, or for the secure provision thereof. The subsequent processing of personal data is carried out for the purpose of contract performance on the basis of Article 6(1)(b) of the GDPR and to ensure IT security on the basis of Article 6(1)(f) of the GDPR.

i) Analysis of the tenant portal using Matomo Cloud

In the tenant portal, we use Matomo Cloud from InnoCraft Ltd, New Zealand. Where the tenant portal is displayed within the app, the analysis described below may also record visits made via the web view embedded in the app. We do not use any additional, standalone native app tracking.

We use Matomo to analyse the use of the tenant portal in order to improve content and functions and to statistically evaluate the use of our digital offering. In particular, the following data may be processed:

  • pages and URLs accessed;
  • time and duration of visits;
  • browser, operating system and device type used;
  • source of the visit;
  • interactions with the tenant portal;
  • truncated IP address;
  • pseudonymous visit and session identifiers.

We configure Matomo so that no content from input fields, no document content and no contract- or property-related information not required for analysis is transmitted to Matomo.

Insofar as Matomo uses cookies or similar technologies to recognise visits, data will only be stored on or accessed from your device with your consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data is based on Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect via the cookie settings provided in the tenant portal.

Usage data is stored in accordance with the Matomo configuration shown in the tenant portal and is subsequently deleted or aggregated in such a way that it can no longer be attributed to individual users.

An adequacy decision has been issued by the European Commission for New Zealand in accordance with Article 45 of the GDPR.

Further information on data processing by Matomo is available at https://matomo.org/matomo-cloud-privacy-policy/.

2. KAI Chatbot and communication functions

In the Tenant Portal and in the ‘Meine KAIFU’ app, we offer the KAI Chatbot as a communication and support feature. The KAI chatbot can provide assistance, in particular, with general enquiries, finding FAQ content, navigating the service area, and recording and pre-structuring enquiries. Where applicable, enquiries submitted via the chatbot may be forwarded to the relevant departments for further processing.

When using the service, the following data in particular may be processed:

  • Contact details and other information provided by users in the chat,
  • the content of chat messages and, where applicable, details regarding an enquiry contained therein,
  • Details regarding the tenancy, the contract or the property in question, insofar as users provide these or they are retrieved from the tenant portal or the app for the purpose of processing the enquiry,
  • details regarding service requests, damage reports and other enquiries,
  • any attachments or other content that may be submitted,
  • technical usage data required for the operation, security and troubleshooting of the communication function.

The processing is carried out to support users, answer questions, record and pre-sort enquiries, forward service requests to the relevant departments, and enable these enquiries to be processed. Insofar as the communication relates to the performance or preparation of a tenancy or other contractual relationship, the processing is carried out on the basis of Article 6(1)(b) of the GDPR. In the case of general enquiries and for the organisation of an efficient customer and tenant service, processing is carried out on the basis of our legitimate interest in accordance with Article 6(1)(f) of the GDPR.

As a general rule, we only store chat and communication content for as long as is necessary to respond to and process the relevant enquiry. If the content is linked to a service request or a report of damage, it may be stored for the duration of the processing and in accordance with statutory retention periods and the documentation requirements applicable to the tenancy agreement. Purely chat histories that do not require any further processing or documentation are deleted or anonymised once the relevant purpose no longer applies, provided there are no statutory or legal grounds for further storage.

To process user inputs, the KAI chatbot uses the Claude AI language model from Anthropic PBC. The model is hosted on Amazon Web Services servers in Europe. The tenant portal, app and chatbot are provided on our behalf by Aareon Deutschland GmbH.

Use of the KAI chatbot is not required to contact us. Users may also contact us via the other contact options set out in this privacy notice.

3. Contacting us

If you call us or send a message via the contact email address provided, we will process the data you provide for the purpose of responding to your enquiry. We process this data on the basis of our legitimate interest in contacting enquirers.

The legal basis for data processing is Article 6(1)(f) of the GDPR.

4. Customer and Prospective Customer Data

If you contact our company as a customer or prospective customer, we will process your data to establish or fulfil the contractual relationship to the extent necessary for this purpose. This regularly includes the processing of the personal master data, contractual data and payment details provided to us, as well as the contact and communication details of our points of contact at commercial customers and business partners. The legal basis for this processing is Article 6(1)(b) of the GDPR for end customers and Article 6(1)(f) of the GDPR when we contact representatives of business customers.

We also process customer and prospect data for analysis and marketing purposes. This processing is carried out on the legal basis of Article 6(1)(f) of the GDPR and serves our interest in further developing our offering and providing you with targeted information about our products and services.

Further data processing may take place if you have given your consent (Article 6(1)(a) of the GDPR) or if this is necessary to comply with a legal obligation (Article 6(1)(c) of the GDPR).

5. Use of your email address for marketing purposes

We may use the email address you provided during registration to inform you about similar products and services offered by us.

The legal basis for this is Section 7(3) of the Unfair Competition Act (UWG). You may object to this at any time without incurring any costs other than the transmission costs in accordance with standard rates. To do so, you can unsubscribe by clicking on the unsubscribe link included in every email.

6. Prize draws

If you take part in a competition organised by us, we will process the data you provide for the purpose of organising and administering the competition. This may include, in particular, your name, contact details, entry fee, details regarding eligibility to enter and – should you win – the data required for notification and delivery of the prize.

The processing serves to verify eligibility criteria, conduct the prize draw, select and notify the winners, and deliver or provide the prize. The legal basis is Article 6(1)(b) of the GDPR.

Where a prize is delivered or provided by another company, we will transfer the winners’ data required for this purpose to the company in question.

Once the competition has concluded, we will delete the data, provided that there are no statutory retention obligations and the data is not required for the assertion, exercise or defence of legal claims. Longer statutory retention periods may apply to information relating to prizes that is relevant under tax or commercial law.

Version: 1.0, 22 September 2026

Information for tenants, members, prospective tenants and guarantors

Last update

Privacy Notice_10_2026

2026-10-07

Download