Privacy Policy
Status: September 2023
Privacy Policy for Website, Contacting, Direct Marketing, and for Events in Accordance With Art. 13 and 14 GDPR
The protection of your personal data is of particular concern to OTTO Immobilien GmbH and OTTO Immobilien Management GmbH (“OTTO”, “we”, “us”). We therefore process your personal data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (“GDPR”), the applicable Datenschutzgesetz (“DSG”) and the Telekommunikationsgesetz (“TKG”). Below you will find out what information we collect, process and use, including when you visit our website www.otto.at (“Website”).
1. Name and Address of the Person Responsible
The person responsible for processing your personal data in accordance with data protection regulations is
OTTO Immobilien GmbH and OTTO Immobilien Management GmbH
Riemergasse 8,
1010 Vienna
Tel: + 43 1 512 77 77
E-mail: office@otto.at
Please contact us directly if you have any questions about data processing concerning you.
2. Data Processing Website
2.1. Scope of the processing of personal data when using the website
In the course of your visit to our website, we will automatically collect the following personal data about you:
The date and time a page on our website was accessed;
Data about your end device (Devide ID);
IP address;
Name and version of your web browser;
Session ID.
For information on the cookies we collect when you visit our website, please refer to our cookie statement.
2.2. Legal bases for the processing of personal data
As far as the data of your visit to our website and online services is concerned, we rely on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to justify the processing, which consists of making our website user-friendly and protecting you from attacks.
2.3. Purpose of data processing
We process your data in connection with your visit to our website for the following purposes:
- to provide you with our website, including its functions, and to further improve and develop this website;
- to be able to create usage statistics;
- to recognise, prevent and investigate attacks on our website and online services.
2.4 Duration of storage
We will generally store your data relating to your visit to the website for a period of 14 days. Data will only be stored for longer if this is necessary to investigate any attacks on our website and only until the end of any applicable limitation periods, statutory retention periods or any legal disputes.
2.5 Recipients of data
We regularly use IT service providers to operate and manage the website, who may also have access to personal data on our behalf and in accordance with our instructions in order to be able to provide the commissioned IT services. We also transfer your personal data to the following recipients:
to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of a claim, etc.);
to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).
Your data will not be passed on to any other third parties for their own purposes without your consent.
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or in the context of the use of third-party services, this will only take place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. At your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.
Insofar as this involves a transfer to countries without an adequacy decision pursuant to Art. 45 para. 3 GDPR and without suitable guarantees pursuant to Art. 46 GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.
3. Data Processing Contacting
3.1. Scope of the processing of personal data when contacting us
If you contact us by e-mail, telephone, fax, post, via our social media channels or via our contact form, we process the personal data you provide (e-mail, name, telephone, etc.) and the content of your enquiry.
If you contact us via our social media pages on Facebook, Instagram or LinkedIn, we will receive your personal data from the respective operators of the social media platform and will also transmit your personal data to the respective operators.
3.2. Legal basis for the processing of personal data
In order to be able to answer your enquiry, we rely on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to justify the processing, which consists of answering your question in a satisfactory manner.
3.3. Purpose of data processing
We process your data in connection with your enquiry for the purpose of providing you with a personalised and satisfactory response.
3.4. Duration of storage
We will generally store your data in connection with inquiries and contacts for a period of six months after answering the inquiry in order to be able to respond to any follow-up questions. Data will only be stored for longer if this is necessary to investigate any attacks on our website and only until the end of any applicable limitation periods, statutory retention periods or any legal disputes.
3.5. Recipients of data
To respond to enquiries, we regularly use IT service providers who may also have access to personal data on our behalf and in accordance with our instructions in order to be able to provide the commissioned IT services.
We also transfer your personal data to the following recipients:
to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of a claim, etc.);
to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).
Your data will not be passed on to any other third parties for their own purposes without your consent.
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or in the context of the use of third-party services, this will only take place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. At your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.
Insofar as this involves a transfer to countries without an adequacy decision pursuant to Art. 45 para. 3 GDPR and without suitable guarantees pursuant to Art. 46 GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.
4. Data Processing for Direct Marketing
4.1. Scope of the processing of personal data for direct marketing
If you give us your voluntary consent to contact you for marketing purposes, we will process your email address, name, telephone number, title and title for the purpose of sending you direct marketing materials about properties and related offers, in-depth market reports, events and similar propertyrelated services by e-mail and telephone.
If you receive a download link for documents via our CRM system in this context, we can also see whether and when (date and time) you have downloaded the files.
4.2. Legal basis for the processing of personal data
We process your data in connection with direct marketing only on the basis of your express consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent to advertising contact at any time, without giving reasons for all or individual purposes and with effect for the future (e.g. via a link at the end of each newsletter).
4.3. Purpose of data processing
We process your data in connection with direct marketing for the purpose of providing you with information about property and related offers, in-depth market reports, events and similar services from the property sector by e-mail and telephone.
4.4. Duration of storage
If you have only registered to receive newsletters and direct marketing and are not a customer of ours, we will store your personal data until you cancel your registration and for a maximum of three years.
4.5. Recipients of data
For the use of direct marketing, we regularly use IT service providers and other service providers who support us in the provision of our services and act on our behalf (including providers of marketing tools, marketing agencies, communication service providers and call centres) (processors).
We also transfer your personal data to the following recipients:
to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of a claim, etc.);
to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or in the context of the use of third-party services, this will only take place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. At your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.
Insofar as this involves a transfer to countries without an adequacy decision pursuant to Art. 45 para. 3 GDPR and without suitable guarantees pursuant to Art. 46 GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.
5. Data Processing Events
5.1. Scope of the processing of personal data at events
Photographs and/or films/videos may be taken by us or on our behalf as part of events. By registering for an event, you acknowledge that photographs and video material in which you are depicted will be stored, used for press coverage and published in various (social) media, publications and on OTTO Immobilien websites (including in blog posts).
5.2. Legal basis for the processing of personal data
We (as the organiser) base the processing of your personal data on our legitimate interest in documentation pursuant to Art. 6 (1) (f) GDPR.
5.3. Purpose of data processing
We process your data for the purposes of documenting the event and for marketing purposes.
5.4. Duration of storage
We store photographs and/or films/videos of events for three years from the date of the event.
5.5. Recipients of data
For the creation of photographs, films/videos, press reports, publications and content for our various (social) media and for the OTTO Immobilien websites (including blog posts), we regularly use (IT) service providers who may also have access to personal data on our behalf and in accordance with our instructions in order to be able to provide the commissioned (IT) services. We also transfer your personal data to the following recipients:
to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of a claim, etc.);
to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).
Your data will not be passed on to any other third parties for their own purposes without your consent.
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or in the context of the use of third-party services, this will only take place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. At your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.
Insofar as this involves a transfer to countries without an adequacy decision pursuant to Art. 45 para. 3 GDPR and without suitable guarantees pursuant to Art. 46 GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.
6. Data Security
We take appropriate technical and organisational security measures to protect your personal data against unintentional or unauthorised deletion, modification or against loss, theft and unauthorised inspection, disclosure, reproduction, use, modification or access. In addition, we and our employees are obliged to maintain data secrecy and confidentiality. Likewise, our processors, who must have access to your personal data in order to fulfil their professional duties, will be granted access and will be subject to the same obligations to maintain data secrecy and confidentiality.
7. Your Rights as the Data Subject
7.1. Right to information
You have the right to request information from us about all personal data concerning you that is processed by us. You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
7.2. Right to rectification and right to restriction of processing
You may request the rectification or completion of incorrect or incomplete data. Under certain circumstances, for example if the accuracy of data is disputed until the accuracy has been verified, you may request that the processing of data be restricted so that it may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
7.3. Right to data portability
You may request that we send you – or, where technically feasible, a third party designated by you – a copy of your data in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where
the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR, and
the processing is carried out using automated procedures.
In exercising this right, you also have the right to obtain that the personal data concerning you be transmitted directly by us to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
7.4. Right to cancellation
You have the right to erasure of data in certain circumstances, for example if it is not processed in accordance with data protection requirements.
If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
7.5. Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR.
In this case, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
7.6. Right to revoke the declaration of consent under data protection law
You have the right to revoke any declaration of consent granted under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
7.7. Supervisory authority
Irrespective of any other legal remedies, you have the right to lodge a complaint with the national supervisory authority of your place of residence if unlawful processing of personal data is assumed. In Austria, the data protection authority, Barichgasse 40-42, 1030 Vienna, e-mail dsb@dsb.gv.at, telephone: +43 1 52 152-0 is responsible.
7.8. Assertion of your rights
To enable us to process your request regarding your above-mentioned rights and to ensure that personal data is not disclosed to unauthorised third parties, please formulate the request by clearly identifying yourself and providing a brief description of the scope of the exercise of your data subject rights listed above.
Data Protection Notice for Applications
The personal data provided by me in the context of my application will be processed by OTTO Immobilien GmbH (FN 391810 t) or OTTO Immobilien Management GmbH (FN 608793 i) or eugen! GmbH (FN 592247 b), Riemergasse 8, 1010 Vienna for the evaluation and allocation of my application as well as for the comparison with open positions or for the purpose of recruiting and thus for the implementation of pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR.
My applicant data (name, form of address, title, contact details, photo, CV, letter of motivation, professional experience, desired employment, date of birth, place of birth, country of birth, citizenship, marital status, driving licence, gender, experience and other voluntarily provided documents such as references, training and further education certificates) will be stored by OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH, if there is an employment relationship, for the duration of the employment and stored after termination of my employment for as long as there are statutory retention obligations (generally seven years for all relevant documents within the meaning of § 132 BAO and § 212 UGB) or as long as legal claims from the employment relationship can be asserted against the employer (usually 3 years). Personal data required for the issuance of a certificate of employment in accordance with § 39 ArbVG, § 1163 ABGB will be stored for a period of 30 years. In addition, my personal data will also be stored beyond the aforementioned periods in the event of a dispute, as long as legal claims arising from the relationship between me and OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH can be asserted or until the final clarification of a specific incident or legal dispute. This longer storage period is necessary to safeguard legitimate interests in the assertion, clarification and defence of legal claims.
If no employment relationship is established, my data will be deleted no later than seven months after the end of the application process, unless I have given my separate consent for longer retention. Until then, they will be kept for the defence of any claims under the GlBG (Art. 6 para. 1 lit. f GDPR).
In addition, my applicant data will be processed for the planning, implementation and documentation of internal auditing measures as well as forensic analyses to ensure continuous improvement of the business processes of OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH (Art. 6 para. 1 lit. f GDPR).
The personal data collected as part of the recruiting tool is processed on behalf of OTTO Immobilien GmbH by Sage GmbH (Stella-Klein-Loew-Weg 15, 1020 Vienna) as a processor on the basis of an agreement in accordance with Art. 28 GDPR.
OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH take appropriate technical and organisational security measures to protect my personal data against accidental or unauthorised deletion, alteration or against loss, theft and unauthorised inspection, disclosure, reproduction, use, modification or access. In addition, OTTO Immobilien GmbH, OTTO Immobilien Management GmbH and eugen! GmbH and their employees are obliged to maintain data secrecy and confidentiality. Likewise, the processors who must have access to my personal data in order to fulfil their professional duties will be granted access and will be subject to the same obligations to maintain data secrecy and confidentiality.
My rights as a data subject:
Right to information
I have the right vis-à-vis OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH the right to information about all data relating to my person that is processed by OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH are processed. I have the right to request information as to whether the personal data concerning me is transferred to a third country or to an international organisation. In this context, I may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
Right to rectification and right to restriction of processing
I can request the rectification or completion of inaccurate or incomplete data. Under certain circumstances, for example if the accuracy of data is disputed until the accuracy has been verified, I may request that the processing of data be restricted so that it may only be processed with my consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.
Right to data portability
I can request that OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH to send me – or, where technically feasible, a third party designated by me – a copy of my data in a structured, commonly used and machine-readable format. I also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where
the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR, and
the processing is carried out using automated procedures.
In exercising this right, I also have the right to have the personal data concerning me transmitted directly from OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
Right to cancellation
I have the right to erasure of data in certain circumstances, for example if it is not processed in accordance with data protection requirements. If I have asserted the right to rectification, erasure or restriction of processing vis-à-vis OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH, they are obliged to inform all recipients to whom the personal data concerning me has been disclosed of this correction or deletion of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
Right to object
I have the right to object, on grounds relating to my particular situation, at any time to processing of personal data concerning me which is based on point (e) or (f) of Article 6 (1) GDPR. OTTO Immobilien GmbH or OTTO Immobilien Management GmbH or eugen! GmbH will no longer process the personal data concerning me unless they can demonstrate compelling legitimate grounds for the processing which override my interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Right to revoke the declaration of consent under data protection law
I have the right to revoke any declaration of consent given under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Supervisory authority
Irrespective of any other legal remedies, I have the right to lodge a complaint with the national supervisory authority of my place of residence if unlawful processing of personal data is assumed. In Austria, the Data Protection Authority, Barichgasse 40-42, 1030 Vienna, e-mail dsb@dsb.gv.at, telephone: +43 1 52 152-0 is responsible.
The person responsible for the processing of my personal data in accordance with data protection regulations is:
OTTO Immobilien GmbH and OTTO Immobilien Management GmbH
Riemergasse 8,
1010 Vienna
Tel: + 43 1 512 77 77
E-mail: office@otto.at
resp.
eugen! GmbH
Riemergasse 8,
1010 Vienna
E-mail: hallo@eugen.at
or the company under the applicable law to which the application was submitted.
In order for a request regarding the above-mentioned rights to be processed and to ensure that personal data is not disclosed to unauthorised third parties, the request must be formulated with a clear identification of my person and a brief description of the scope of the exercise of my data subject rights listed above.
