Privacy Policy
1. General
The protection of your privacy and the lawful processing of your personal data are very important to us. As the controller, we wish to make our processing activities transparent to you and to inform you, in the following data privacy statement, about how your personal data shall be processed if you use this website, contact us, express an interest in one of our real estate offers and request information concerning this or other real estate offers and/or conclude a contract with us.
2. Definitions
The terms regarding data protection legislation used in this data privacy statement, such as “personal data”, “processing” and “controller”, are defined in Art. 4 of the General Data Protection Regulation (GDPR).
3. Name and contact details of the controller responsible for the processing and of the data protection officer
The controller responsible for your personal data is:
BAI Bauträger Austria Immobilien GmbH, FN 466793 k, 1020 Wien, Jakov-Lind-Straße 2, Tel.: +43 1 33146 – 0, E-Mail.: vermietung@bai.at
In addition to the controller, you can also get in touch with the relevant data protection officer using the following contact details:
E-Mail.: datenschutz@signa.at
Postal-Adress:
SIGNA, 1010 Wien
Freyung 3
Attn. Datenschutzkoordinator
4. Categories of personal data which we process about you / sources of data
Personal data are any information relating to an identified or identifiable person, and therefore information that can be assigned to you individually. Examples include your name, address, telephone number, e-mail address or IP address. As described below, we process various personal data relating to you that we have received from you within the framework of our (business) relationship with you. We also process data that we have legitimately received from brokers and advisors or from publicly accessible sources (e.g. companies’ register, land register, etc.).
Use of our website:
If you use our website, certain information shall be collected (further details under “Server log files”). In addition, data shall be collected through the use of cookies, tracking and online marketing tools and plug-ins (further details below).
Contact form / contacting us:
If you show an interest in our real estate offers by filling in the contact form, we shall process your First- und Last-name, Telephonenumber, E-Mail-Adress, Remarks and the text of your comments which you provide to us via the free text field. We shall also process further personal data that you have communicated to us voluntarily. In addition, we shall process personal data that you have voluntarily disclosed in connection with communication with us or towards our advisors or brokers.
Alternatively, you can also contact us using our contacts details as displayed on the website (e.g. by email or telephone). In this case, the data supplied by you shall be processed.
Real estate brokerage:
Within the framework of real estate brokerage, we shall essentially process your master data and contact details, as well as contract and property data, account and payment details, correspondence and all other data required for identification purposes and to perform the contractual relationship.
Within the context of our engagement, it may also be necessary for us to process special categories of data, such as data relating to your health (pursuant to Art. 9(1) GDPR). To this end, we shall obtain your consent (pursuant to Art. 6(1)(a), Art. 7 and Art. 9(2)(a) GDPR), if necessary.
5. Relevant legal bases
If and insofar as the legal basis is not mentioned in the data privacy statement, the following shall apply: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR and/or Art. 9(2)(a) GDPR; the legal basis for processing to provide our services and implement contractual measures as well as to respond to enquiries is Art. 6(1)(b) GDPR; the legal basis for processing to fulfil our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR. For the event that vital interests of the data subject or of another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
6. Contact form / contacting us
If you submit the contact form, your personal data in the contact fields (First- und Last-name, Telephonenumber, E-Mail-Adress, Remarks) shall be processed for the purpose of contacting you and regularly sending invitations to events and information relating to our real estate offers. The processing of the data entered in the contact form as well as the forwarding of such data to third parties shall be based on your consent (pursuant to Art. 6(1)(a) GDPR) for the purposes stated. There is no obligation to actually provide the data that we request from you on our website. The personal data supplied by you via the contact form shall be processed for as long as we offer our aforementioned service in relation to our real estate offers to you and provided that you do not withdraw your consent. Your personal data shall, in any case, be erased 3 years after its last use, unless there are statutory retention periods.
Registration via the contact form shall involve the double opt-in procedure. Once you have sent your enquiry, you shall receive an automated e-mail from us containing a verification link for the purpose of confirming that the data you have provided are yours.
If, on the other hand, you get in touch with us using the contact details available on the website (e.g. by e-mail or telephone), the personal data that you have supplied to us voluntarily shall be processed for the purpose of handling the enquiry and to deal with any follow-up enquiries on the basis of your consent (pursuant to Art. 6(1)(a) GDPR). In this case, we shall erase your personal data if and insofar as such data are no longer required and/or the erasure is not opposed by statutory retention periods.
Withdrawal of consent:
Your consent may be withdrawn in full or in part at any time with future effect by getting in touch with the controller using the contact details above (under point 3.). Such withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.
7. Real estate brokerage
If we are close to concluding a contract with you on the basis of your interest and/or enquiry, Art. 6(1)(b) GDPR (to fulfil contractual or pre-contractual obligations) shall also come into question as a further legal basis for processing your data within the framework of real estate brokerage. The purpose of the processing shall be the specific negotiation and preparation of a rental contract and/or a real estate purchase contract between you and the lessor and/or the seller as well as all other associated and required activities and actions.
The data shall be retained for the duration of the contractual relationship and thereafter at least for as long as statutory retention periods exist or until limitation periods for potential legal claims expire.
You shall be obliged to provide personal data that are necessary for proper performance of the contractual relationship and which we are obliged by law to collect. As a rule, if you do not wish to make the data available to us, we must decline to conclude the contract. In this case, we shall no longer be able to perform an existing contract. However, data that are not necessary for proper performance of the business relationship or not legally required do not have to be provided. The communication of such data shall then be voluntary.
8. Server log files
The provider of the website automatically collects and stores information (browser type and browser version, operating system used, referrer URL, host name of the computer accessing the website, time of the server request and IP address) in server log files which your browser transmits automatically.
The data collected are used to ensure that connection to the website is established smoothly, to make sure that our website is user-friendly and to analyse system security and stability. We reserve the right to subsequently examine these data if we become aware of specific indications of unlawful use. These data are not merged with other data sources.
The legal basis for such data processing is Art. 6(1)(f) GDPR. The legitimate interest arises from the purposes for data collection as listed above.
Server log files are stored for a period of 180 days and then erased. Data whose further retention is required for evidentiary purposes are excluded from such erasure until the incident concerned is finally resolved.
The recording of data to provide the website and the storage of these data in log files are absolutely essential for operation of the website. There is therefore no option to object to such usage in this case.
10. Google Analytics
Our website uses Google Analytics, a web analytics service provided by Google LLC (“Google”). Google Analytics uses cookies that are stored on your device and enable an analysis of your use of the website (including your IP address and the URLs of the websites accessed). As a rule, the information generated thereby is transmitted to and stored by Google on a server in the USA. Google is certified under the Privacy Shield agreement and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
This website uses the IP anonymisation facility offered by Google Analytics. As a result, your IP address shall be truncated by Google beforehand within the Member States of the European Union or in other countries that are signatories of the treaty on the European Economic Area. Only in exceptional cases shall the full IP address be sent to a Google server in the USA to be truncated there. On behalf of the operator of this website, Google shall use this information to analyse your use of the website, to compile reports on website activity and to provide other services associated with the use of this website and the internet in general for the website operator. No connection shall be established between the IP address sent by your browser within the scope of Google Analytics and any other Google data.
We have concluded a data processing agreement with Google.
Data processing takes place on the basis of Art. 6(1)(a) GDPR (consent). We use Google Analytics to generate website access statistics that are easy to use and, as a consequence, to improve our offering and our web presence.
As described above, you can prevent the storage of cookies by configuring your browser software accordingly. You can also prevent Google from collecting your data in connection with Google Analytics by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en
Alternatively, you can prevent any recording of your data by Google Analytics by clicking on the following link. This installs an opt-out cookie which prevents any recording of your data during future visits to this website:
Personal data are erased after 14 months.
Further information on Google’s Terms of Service and Google’s Privacy Policy can be found at https://www.google.com/analytics/terms/us.html and https://www.google.com/intl/en/policies/privacy/index.html.
11. Google Tag Manager
This website uses Google Tag Manager. Google Tag Manager is a solution that enables marketers to manage website tags through a single interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect personally identifiable information. The tool triggers other tags, which may collect data. Google Tag Manager does not access this data. If disabled at the domain or cookie level, it will remain in effect for all tracking tags implemented with Google Tag Manager. For more information about Google Tag Manager, visit https://www.google.com/analytics/tag-manager/use-policy/
12. Google AdWords – conversion tracking
To record the use of our website statistically and for the purpose of optimising our website, we shall also use Google’s conversion tracking facility on the basis of your consent (pursuant to Art. 6(1)(a) GDPR). Google AdWords shall install a cookie on your computer provided that you have reached our website via a Google ad. These cookies lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of the website of the AdWords customer and the cookie has not yet expired, Google and the customer can detect that the user has clicked on the ad and been redirected to this page. Every AdWords customer receives a different cookie. Therefore, cookies cannot be tracked via the websites of AdWords customers. The information obtained with the help of the conversion cookie is used to generate conversion statistics for AdWords customers who have opted for conversion tracking. AdWords customers learn the total number of users who have clicked on their ad and been redirected to a page equipped with a conversion tracking tag. However, they do not receive any information that can be used to identify users personally. If you do not wish to take part in the tracking process, you can also reject the required cookie installation, such as by generally disabling the automatic installation of cookies in your browser settings. You can also disable cookies for conversion tracking by configuring your browser so that cookies from the domain www.googleadservices.com are blocked.
Google is certified under the Privacy Shield agreement and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Further information on data protection at Google can be found at http://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats/en.html.
13. Google - Remarketing-Technology
We use Google Remarketing Tags. These are the services of Google Inc. (1600 Amphitheater Parkway, Mountain View, CA 94043, USA, hereafter “Google”). Google uses cookies that are stored on your computer and that enable you to analyze the use of the website by you. The information generated by the cookie about your use of this website (including your IP address) will be transmitted to and stored by Google on servers in the United States. The IP address is then shortened by Google for the last three digits, a clear assignment of the IP address is therefore no longer possible. Google complies with the US-EU and US-Swiss Safe Harbor Privacy Policies and is registered with the US Department of Commerce’s equivalent Safe Harbor programs. Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators and to provide other services related to website activity and internet usage.
Google may also transfer this information to third parties if required by law or as far as third parties process this data on behalf of Google. Third parties, including Google, place ads on websites on the Internet. Third parties, including Google, use stored cookies to serve ads based on previous visits by a user to this site. Google will never associate your IP address with other Google data. The data collection and storage can be contradicted at any time with effect for the future. You can disable Google's use of cookies by visiting the Google Ads Disabling page (https://adssettings.google.com/u/0/authenticated). However, please be aware that if you do this you may not be able to use the full functionality of this website. The data collection and storage can be objected to at any time with effect for the future. You can find more information about Google's terms here (https://policies.google.com/privacy?hl=en).
14. Use of Facebook pixels, Custom Audiences and Facebook remarketing
With your consent and in the interests of analysis, optimisation and economical operation of our online offering and for these purposes, we use within our online offering, pursuant to Art. 6(1)(a) GDPR, the “Facebook pixel” of the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA or (if you are resident in the EU) by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).
Facebook is certified under the Privacy Shield agreement and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
The Facebook pixel allows Facebook to identify the visitors to our website as a target group for the display of advertisements known as “Facebook ads”. To this end, Facebook’s remarketing tag has been implemented on this website. This tag establishes a direct link to the Facebook servers when the website is visited. This communicates to the Facebook servers that you have visited this website, and Facebook assigns this information to your personal Facebook user account.
Further information on the collection and use of data by Facebook as well as on your rights and options to protect your privacy in this regard can be found in Facebook’s Data Policy at https://www.facebook.com/about/privacy/.
The remarketing function “Custom Audiences” can be disabled at "https://www.facebook.com/settings/?tab=ads#_=_". You must be logged into Facebook to do this.
15. Information on the embedding of videos via Vimeo
We have embedded Vimeo videos on our website, which are stored at “www.vimeo.com” and can be played directly from our website. To increase the protection of your data when you visit our website, the videos have been embedded into the site using the double-click solution, which means that no data are transferred to Vimeo about you as a user if you do not play the videos. Only if you play the videos and, by doing so, consent to the transmission of data shall Vimeo cookies be stored on your computer and data transferred to Vimeo, Inc. 555 West 18th Street New York, New York 10011. If you are logged into your Vimeo account, you are hereby enabling Vimeo to assign your browsing behaviour to your personal profile directly. You can prevent this by logging out of your Vimeo account.
Vimeo is used in the interests of an appealing presentation of our online offerings. This represents a legitimate interest within the meaning of Art. 6(1)(f) GDPR.
Further information on the handling of user data can be found in Vimeo’s Privacy Policy at: https://vimeo.com/privacy.
16. Use of the mailing service provider
For mailing purposes we use “MailChimp”, a mailing platform belonging to the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. The Privacy Policy of this mailing service provider can be viewed here: https://mailchimp.com/legal/privacy/.
The First- und Last-name, Telephonenumber, E-Mail-Adress, Remarks of our recipients are stored on MailChimp’s servers in the USA. MailChimp uses this information for mailing and analysis on our behalf. MailChimp can also, according to its own information, use these data to optimise or improve its own services, e.g. for technical optimisation of the mailing process and the presentation. However, MailChimp does not use data belonging to our recipients to contact them itself, nor does it forward data to third parties.
MailChimp is certified under the Privacy Shield agreement and thereby offers a guarantee of compliance with European data protection law. This mailing service provider is deployed on the basis of a data processing agreement pursuant to Art. 28(3) GDPR, in which MailChimp undertakes to protect your personal data and to process it on our behalf.
17. Matomo
Matomo is an open source web analytics platform. A web analytics platform is used by a website owner in order to measure, collect, analyse and report visitors data for purposes of understanding and optimizing their website.
Purpose of the processing
Matomo is used to analyse the behaviour of the website visitors to identify potential pitfalls; not found pages, search engine indexing issues, which contents are the most appreciated… Once the data is processed (number of visitors reaching a not found pages, viewing only one page…), Matomo is generating reports for website owners to take action, for example changing the layout of the pages, publishing some fresh content… etc.
Matomo is processing the following personal data:
- Cookies
- IP address (Shortened by the last 2 bytes)
- User ID
- Location of the user
- Title of the page being viewed
- URL of the page being viewed
- URL of the page that was viewed prior to the current page
- Screen resolution
- Files that were clicked and downloaded
- Pages generation time
- Country, region, city
- Main Language of the browser
- User Agent of the browser
The processing of personal data with Matomo is based on explicit consent. Your privacy is our highest concern. That’s why we will not process any personal data with Matomo unless you give us clear explicit consent.
As Matomo is processing personal data on explicit consent, you can exercise the following rights:
- Right of access: you can ask us at any time to access your personal data.
- Right to erasure: you can ask us at any time to delete all the personal data we are processing about you.
- Right to portability: you can ask us at any time for a copy of all the personal data we are processing about you in Matomo.
- Right to withdraw consent: you can withdraw your consent at any time by clicking on the following button.
The right to withdraw consent at any time
You can withdraw at any time your consent by clicking here (insert here the Matomo tracking code to remove consent).
The right to lodge a complaint with a supervisory authority
If you think that the way we process your personal data with Matomo analytics is infringing the law, you have the right to lodge a complaint with a supervisory authority.
Whether the provision of personal data is part of a statutory or contractual requirement; or obligation and possible consequences of failing to provide the personal data
If you wish us to not process any personal data with Matomo, you can opt-out from it at any time. There will be no consequences at all regarding the use of our website.
18. Forwarding of data
Data shall only be forwarded to fulfil (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the grounds of our legitimate interests.
All processors are contractually obliged by us on the basis of Art. 28 GDPR to comply with applicable data protection legislation in relation to us. Alongside the service providers referred to in the data privacy statement, the IT service provider (currently SIGNA Informationstechnologie GmbH) in particular works for us as a processor.
If and insofar as we are required by law or to fulfil a contract, we shall disclose or transmit your data, among other things, to the following recipients:
- Third parties involved in the transaction (including persons required to take part in the transaction and potential contracting parties, financing companies, credit institutions and insurers, etc.);
- Service providers (including tax advisors, property managers, insurers, accountants, lawyers, ombudsman’s offices and other service providers, etc.); and
- The tax office and other authorities, tax advisors and legal representatives (with the enforcement of rights or defence against claims or as part of official proceedings).
Obviously, your data shall only be passed on to the extent required for the respective purpose of the processing.
Transmission to recipients in a third country (outside the EU) or to an international organisation is not intended, with the exception of the automated sending of e-mails via MailChimp as well as within the context of tracking and online marketing tools (further details on this above). MailChimp, Google and Facebook are certified under the Privacy Shield agreement and thereby guarantee compliance with European data protection law.
19. Data security
We implement appropriate technical and organisational measures to guarantee the security of the data processing and to process your personal data in a manner that provides protection against access by unauthorised third parties.
In spite of our security measures, it is impossible to rule out the fact that information which you supply to us via the internet, especially also within the framework of unencrypted e-mails, may be viewed and used by other persons.
20. Changes to this data privacy statement
We reserve the right to adapt the information provided in this data privacy statement, without prior notice, to changes in legislation and case-law and/or to amend it for organisational reasons. The latest version published here shall apply.
21. Your rights in connection with personal data
Pursuant to the GDPR, as the data subject you are entitled to the following rights.
Right of access:
You have the right to obtain information from us about whether we are processing personal data belonging to you and which data this concerns as well as further information pursuant to Art. 15 GDPR.
Right to rectification:
Pursuant to Art. 16 GDPR, you have the right to obtain the rectification of inaccurate personal data concerning you and/or – taking into account the purposes of the data processing – the completion of incomplete personal data.
Right to erasure of data ("right to be forgotten"):
You have the right to erasure of your data provided that the conditions of Art. 17 GDPR are met.
Right to restriction of processing:
In accordance with Art. 18 GDPR, you have the right to restriction of the processing of all personal data collected.
Right to data portability:
You have the right to data portability provided that the conditions of Art. 20 GDPR are met.
Right to withdraw consent:
If processing is based on consent, you also have the right to withdraw this consent at any time (see Art. 7(3) GDPR for details). Withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.
Right to object:
Pursuant to Art. 21(1) GDPR, you have the right at any time to object, on grounds relating to your particular situation, to the processing of relevant personal data which are necessary to protect our legitimate interests or those of a third party (Art. 6(1)(f) GDPR). If you object, your data shall no longer be processed unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.
Pursuant to Art. 21(2) and (3) GDPR, you also have the right to object to data processing for direct marketing purposes; such objection shall have future effect.
Assertion of rights and the right of appeal:
To assert your aforementioned rights, you can get in touch with the controller using the contact details above (under point 3.) and state your request.
To protect your privacy and security, we reserve the right to check your identity before we take any of the above measures.
The protection and lawful processing of your personal data are very important to us. If you have any questions or concerns about the processing of your personal data, please get in touch with us using the above contact details for the controller (under point 3.) or contact the data protection officer. If, however, you feel that the processing of your personal data is unlawful, you can also turn to a data protection authority.