Data Protection Declaration
Last change: 5.10.2021
When operating the www.caimmo.com website, the CA Immobilien Anlagen Aktiengesellschaft specified in legal notice (hereinafter shortly “We”) shall act as controller in terms of the GDPR.
By providing you with this Privacy Policy, We shall inform you about the extent to which We shall process personal data of you in the context of your visit to our website. Unless otherwise indicated in this Privacy Policy, We (or our processors) shall collect your personal data directly from you and shall not obtain them from third parties.
We are aware of the great significance of your data and shall thus, in principle, not transfer it to third countries and international organisations. If individual data processing operations are nonetheless related to any transfer of your data to a third country, We shall explicitly notify you thereof in this Privacy Policy and shall inform you about the measures We took to ensure the required level of protection of your data.
You shall not be obliged, in principle, to make your personal data available to us. Where a statutory or contractual obligation to provide your data exists or this is necessary to conclude a contract with us, this has been explicitly stated below. In this case, We shall also inform you about the potential consequences of the non-provisioning of your data.
We shall not use your data for any automated decision-making including profiling in terms of point (f) of Art. 13(2) and point (g) of Art. 14(2) GDPR.
Due to the advancement of our website or legal changes, it may become necessary to amend this Privacy Policy. The respective version published at this website shall apply.
Detailed information on the individual data processing operations can be found hereinafter.
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer, with the following data being collected and retained in the log files of our system:
- the user’s IP address;
- http method and http version;
- access status / status code of the server responder;
- browser version;
- referrer URL (website from which the user’s system accesses our website);
- visitor’s user name (if logged in via system login; no logging of the user name if the user is logged into a web application having an own user management);
- request date and time and number of sent bytes;
- server responses;
- error codes.
The temporary storage of the IP address by the system is necessary to allow for the website delivery to the user’s computer. To this end, the user’s IP address must remain stored for the duration of the session.
It shall be stored in log files to ensure the functionality of the website. Moreover, the data shall serve us to optimise the website and to ensure the security of our IT systems. The data shall not be evaluated for marketing purposes in this context.
The legal basis for the temporary retention of the data and log files shall be our legitimate interest under point (f) of Art. 6(1) GDPR. Our legitimate interest in the data processing shall be the achievement of the purposes outlined under point 1.2.
After the end of the respective session, the data shall be either erased or anonymised or retained in log files. Where the data is retained in log files, it shall be erased after (60 days).
The data shall not be further retained in any form allowing to identify the data subject.
We shall call on service providers to provide and, in particular, to technically handle our website who shall process your data by our order (called “Processors”). We shall make use of the following Processors:
- CA Immobilien Anlagen Aktiengesellschaft and CA Immo Deutschland GmbH
- website provider (supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna)
- IT service providers (Prescreen International GmbH, Mariahilfer Straße 17, 1060 Vienna, Austria / Mailingwork GmbH, Birkenweg 7, 09569 Oederan / supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna)
- web agency (supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna)
In addition, your data shall be disseminated to the following recipients, where necessary and appropriate:
- authorities (e.g. Labour Inspectorate, municipal, district administration and federal authorities, tax office, police / public prosecutor’s office, corporate/land register, OePR etc);
- legal representatives and notaries;
- courts.
Cookies are small text files stored on your terminal (PC/laptop, tablet or smartphone). These text files are downloaded by your browser the first time you visit our website. If this website is accessed once again using the same terminal/browser, the cookie and the information saved in it are either sent back to the respective website having generated them (first-party cookie) or sent to a different website to which they appertain (third-party cookie). In this way, the website “recognises” that this is the same user and adapts the presentation of website contents. Cookies thus “remember” your preferences, communicate how you use a site and individually adapt the displayed offerings to some extent.
We shall use several functionally necessary cookies on our website. When using functionally necessary cookies, We shall process your personal data in order to provide basic functions of our website and of the services desired by you as well as to temporarily save your cookie settings. Functional restrictions would arise if these cookies would not be used. The specific purpose of the individual cookies shall follow from the table below.
The legal basis for the processing of your data when using functionally necessary cookies shall be our legitimate interests in both the provisioning of a fully functional website and of the services desired by you and the temporary saving of your cookie settings (point (f) of Art. 6(1) GDPR).
The following functionally necessary cookies shall be used on our website:
Cookies | Data types | Purposes | Retention period | Recipients |
supi | consent to the individual cookies | retains information on allowed cookies | 1 month | supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna |
fe_typo_user | website personalization information | tells TYPO3 all the information to personalize the website (eg login, forms, etc.) | session end | supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna |
be_typo_user | user ID | notifies Typo3 whether the visitor is logged into the Typo3 back end and of the back end user type | session end | supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna |
be_lastLoginProvider | user ID | contains the key of the used Typo3 back end login provider | 90 days | supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna |
ps_widget_token | session | serves to identify the user while using Prescreen via jobs widget | 1 week | none |
PHPSESSID | PHP session identifier | PHP standard session identification | session end | supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna |
We use the “Matomo” open source web analysis tool setting not functionally necessary cookies to improve the user friendliness of our website. Then using not functionally necessary cookies and subsequently analysing the user data, We shall process personal data to learn about the preferences of our website visitors and in order to better personalise our offering. The specific purpose of the individual cookies shall follow from the table below.
The legal basis for the processing of your data when using not functionally necessary cookies shall be your explicit consent (point (a) of Art. 6(1) GDPR). We shall neither set cookies for web analysis purposes nor process personal data without your explicit consent.
A given consent given may be withdrawn at any time by [enabling the withdrawal link]. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
The following not functionally necessary cookies shall be used on our website for web analysis purposes:
Cookies | Data types | Purposes | Retention period | Recipients |
_pk_ref | referrer URL | records the website from which you visit us | 6 month | ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg |
_pk_cvar | session | contains user-defined variables stipulated during the previous site view | 30 minutes | ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg |
_pk_id | user ID | retains a unique user ID | 13 month | ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg |
_pk_ses | session | displays a visitor’s active session | 30 minutes | ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg |
We shall call on the Matomo Cloud, operated by ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg, Germany, to operate Matomo. This service provider was carefully selected and meets high data protection and security standards. We shall only disseminate information necessary for the offered services to it and shall contractually obligate it to treat all information We disseminate to it as confidential and to process personal data only according to our instructions. The privacy policy for the Matomo Cloud can be found here.
This Processor shall call on a sub-processor, Amazon Web Services Inc., 410 Terry Avenue North, Seattle WA 98109, USA, to process data. Any and all data shall be processed by the sub-processor in Frankfurt, Germany. We cannot rule out nonetheless that our sub-processor will be obligated by US security authorities, for example, to disclose the data processed on the servers in Frankfurt due to its company being based in the USA. According to the European Court of Justice, the USA do not have an adequate level of data protection. We thus obligated our Processor to conclude standard contractual clauses with Amazon Web Services Inc. to ensure an adequate level of data protection and shall use this service only with your consent.
The map material of Google Maps shall be embedded to professionally display the contents of our website. We shall use this service to offer object localisation. Personal data of you shall be processed when using Google Maps.
The legal basis for the data processing shall be your given consent under point (a) of Art. 6(1) GDPR.
You may consent by placing the relevant check mark in our consent banner or accessing the application retrospectively. If no consent has been given to that end, the Google Maps content shall not be loaded and thus no data shall be transmitted or retained.
A given consent given may be withdrawn again at any time by [enabling the withdrawal link below the map presentation]. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The non-granting or withdrawal of consent shall merely result in Google Maps no longer being provided.
We shall not retain data permanently.
Your data shall be disseminated to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which, in turn, shall disseminate your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.
Google Ireland Limited shall disseminate your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. According to the European Court of Justice, the USA do not have an adequate level of data protection. In particular, US intelligence agencies can access your data without you being notified and it being possible for you to take legal action in that respect. We thus concluded standard contractual clauses with Google LLC to ensure an adequate level of data protection and shall use this service only with your consent. Detailed information on the data processing by Google can be found at https://policies.google.com/privacy?hl=en-GB.
We shall process data to play back videos on our website.
The video material of YouTube shall be embedded to professionally display the contents of our website. We shall use this services to publish YouTube videos on our website. Personal data of you shall be processed when using YouTube.
The legal basis for the data processing shall be your given consent under point (a) of Art. 6(1) GDPR.
You may consent by placing the relevant check mark in our consent banner or accessing the application retrospectively. If no consent has been given to that end, the YouTube content shall not be loaded and thus no data shall be transmitted or retained.
A given consent given may be withdrawn again at any time by [enabling the withdrawal link below the video]. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The non-granting or withdrawal of consent shall merely result in the YouTube content no longer being provided.
We shall not retain data permanently.
Your data shall be disseminated to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which, in turn, shall disseminate your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.
Google Ireland Limited shall disseminate your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. According to the European Court of Justice, the USA do not have an adequate level of data protection. In particular, US intelligence agencies can access your data without you being notified and it being possible for you to take legal action in that respect. We thus concluded standard contractual clauses with Google LLC to ensure an adequate level of data protection and shall use this service only with your consent. Detailed information on the data processing by Google can be found at https://policies.google.com/privacy?hl=en-GB.
We shall provide video material from the operation of cameras on the construction sites of CA Immo on our website, in particular to inform the interested public about the construction progress. The recordings of the construction site cameras shall be made in coarse granularity/resolution and from a great distance with the result that neither persons nor vehicles can be zoomed in and thus easily identified.
Detailed information about this data processing can be found here.
If you log into our website for our newsletter, We shall process the contact data specified by you (title, first name, surname, e-mail address) with your consent to send our newsletter to the specified e-mail address.
Our newsletter shall contain information in relation to our company in connection with real estate and land plot transactions, personnel changes, project developments, events and award ceremonies, stock (exchange) news, balance sheet and annual financial statements.
In this case, the legal basis for the processing of your personal data shall be the consent voluntarily given by you and withdrawable at any time under point (a) of Art. 6(1) GDPR.
You may withdraw your consent and unsubscribe the newsletter at any time by clicking on the unsubscribe link contained in each newsletter e-mail. If you withdraw your consent, you shall not receive any newsletter from us.
The newsletter shall be sent as long as you have not unsubscribed the newsletter dispatch.
We shall keep your data until you cancel the newsletter subscription. If you unsubscribe the newsletter, this shall be noted automatically, with the result that you shall not receive any further newsletter as from the time of your unsubscription. Title, first name and surname shall then be erased within 7 days at the longest. For reasons of proof, the consent given to receive the newsletter (including e-mail address as well as subscription and unsubscription date) shall be retained longer, but shall be erased 3 years from the newsletter unsubscription at the latest.
We shall call on a service provider (Processor) to dispatch the newsletter. mailwork - Der Direktmarketing-Partner GmbH, Am Busbahnhof 1, 24784 Westerrönfeld, shall send our newsletter by our order. To that end, We shall transfer to the company the contact data you provided.
As data subject, you shall have the following rights in relation to the processing of your personal data:
Right to Withdraw Consent
Where your data is processed based on your consent, you shall be entitled to withdraw your consent at any time. We shall no longer process this data in future as from receipt of your withdrawal. The withdrawal of consent shall not affect, however, the lawfulness of processing made up to the time of withdrawal.
Right of Access
You may demand access to the data processed on your person, in particular on the origin and categories of data processed, the retention period, the recipients to whom your personal data will be or were disclosed, the purpose or nature of processing. On demand, We shall provide you with a copy of your personal data processed by us.
We point out that no access is to be granted if this results in business or trade secrets of the controller or third parties being jeopardised.
Right to Rectification
If We process inaccurate or incomplete data on your person, you may demand its rectification or completion, even by giving a complementary notice.
Right to Erasure
You shall have the right to obtain from us erasure of personal data concerning you. We will gladly erase your data to the extent provided for by law (Art. 17 GDPR).
We point out that there shall be no right to erasure, in particular, if We must process the data to meet a legal obligation or in order to establish, exercise or defence legal claims.
Right to Restriction of Processing
Where it is not clear whether the data processed on your person is inaccurate or incomplete or processed unlawfully, you may obtain from us restriction of use of your personal data.
Right to Object
Even if the data on your person is accurate and complete and lawfully processed by us, you may object to the processing of this data in particular individual cases substantiated by you. You may also object if you receive direct marketing from us and do no longer want to it in future.
Right to Data Portability
If We process personal data you provided us of you, you may obtain from us transfer of this data to you in a machine-readable format under certain circumstances. You may also engage us to directly transfer this data to a third party selected by you, where this is technically feasible.
Right to Lodge a Complaint
Even if We make best efforts to ensure the protection and integrity of your data, disagreements about the way We use your data may not be ruled out. If you take the view that your data is processed in violation of the GDPR, you shall be free to both establish contact with our data protection coordination team and lodge a complaint with the Austrian data protection authority.
8. Contact
Regarding all of your concerns under data protection law, in particular to assert your rights, please contact in writing (by letter or e-mail) the address specified in the legal notice. Alternatively, you may also directly address our data protection officer (dsb@caimmo.com).