Data Protection Declaration


Last change: 7.7.2021

When operating the www.caimmo.com website, the CA Immo Group company specified in legal notice (hereinafter shortly “We”) shall act as controller in terms of the GDPR.

By providing you with this Privacy Policy, We shall inform you about the extent to which We shall process personal data of you in the context of your visit to our website. Unless otherwise indicated in this Privacy Policy, We (or our processors) shall collect your personal data directly from you and shall not obtain them from third parties.

We are aware of the great significance of your data and shall thus, in principle, not transfer it to third countries and international organisations. If individual data processing operations are nonetheless related to any transfer of your data to a third country, We shall explicitly notify you thereof in this Privacy Policy and shall inform you about the measures We took to ensure the required level of protection of your data.

You shall not be obliged, in principle, to make your personal data available to us. Where a statutory or contractual obligation to provide your data exists or this is necessary to conclude a contract with us, this has been explicitly stated below. In this case, We shall also inform you about the potential consequences of the non-provisioning of your data.

We shall not use your data for any automated decision-making including profiling in terms of point (f) of Art. 13(2) and point (g) of Art. 14(2) GDPR.

Due to the advancement of our website or legal changes, it may become necessary to amend this Privacy Policy. The respective version published at this website shall apply.

Detailed information on the individual data processing operations can be found hereinafter.

 

Content

1.    Website Provisioning (Log Files & Hosting)
1.1.    Data Processing Scope
1.2.    Data Processing Purpose 
1.3.    Legal Basis 
1.4.    Retention Period 
1.5.    Recipients 
2.    Cookies & Tracking 
2.1.    Definition of Cookies 
2.2.    Functionally Necessary Cookies 
2.2.1.    Data Processing Purpose 
2.2.2.    Legal Basis
2.2.3.    Data Types, Retention Period, Recipients
2.3.    Matomo Web Analysis
2.3.1.    Data Processing Purpose
2.3.2.    Legal Basis
2.3.3.    Data Types, Retention Period, Recipients
2.3.4.    Processors
2.4.    Modification of Your Cookie Settings
3.    Embedding of Google Maps 
3.1.    Data Processing Purpose
3.2.    Legal Basis
3.3.    Retention Period
3.4.    Recipients
3.5.    Transfer to Third Countries
4.    Embedding of Video Services 
4.1.    Data Processing Purpose
4.2.    Legal Basis
4.3.    Retention Period
4.4.    Recipients
4.5.    Transfer to Third Countries
5.    Construction Site Cameras
6.    Newsletter
6.1.    Data Processing Purpose
6.2.    Legal Basis
6.3.    Retention Period
6.4.    Recipients
7.    Your Rights
8.    Contact

Provision of the website and creation of log files

Data Processing Scope

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer, with the following data being collected and retained in the log files of our system:

  • the user’s IP address;
  • http method and http version;
  • access status / status code of the server responder;
  • browser version;
  • referrer URL (website from which the user’s system accesses our website);
  • visitor’s user name (if logged in via system login; no logging of the user name if the user is logged into a web application having an own user management);
  • request date and time and number of sent bytes;
  • server responses;
  • error codes.

Data Processing Purpose

The temporary storage of the IP address by the system is necessary to allow for the website delivery to the user’s computer. To this end, the user’s IP address must remain stored for the duration of the session.

It shall be stored in log files to ensure the functionality of the website. Moreover, the data shall serve us to optimise the website and to ensure the security of our IT systems. The data shall not be evaluated for marketing purposes in this context.

Legal Basis

The legal basis for the temporary retention of the data and log files shall be our legitimate interest under point (f) of Art. 6(1) GDPR. Our legitimate interest in the data processing shall be the achievement of the purposes outlined under point 1.2.

Retention Period

After the end of the respective session, the data shall be either erased or anonymised or retained in log files. Where the data is retained in log files, it shall be erased after (60 days).

The data shall not be further retained in any form allowing to identify the data subject.

Recipients

We shall call on service providers to provide and, in particular, to technically handle our website who shall process your data by our order (called “Processors”). We shall make use of the following Processors:

  • CA Immobilien Anlagen Aktiengesellschaft and CA Immo Deutschland GmbH
  • website provider (supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna)
  • IT service providers (Prescreen International GmbH, Mariahilfer Straße 17, 1060 Vienna, Austria / Mailingwork GmbH, Birkenweg 7, 09569 Oederan / supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna)
  • web agency (supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna)

In addition, your data shall be disseminated to the following recipients, where necessary and appropriate:

  • authorities (e.g. Labour Inspectorate, municipal, district administration and federal authorities, tax office, police / public prosecutor’s office, corporate/land register, OePR etc);
  • legal representatives and notaries;
  • courts.

 

Use of cookies

Definition of Cookies

Cookies are small text files stored on your terminal (PC/laptop, tablet or smartphone). These text files are downloaded by your browser the first time you visit our website. If this website is accessed once again using the same terminal/browser, the cookie and the information saved in it are either sent back to the respective website having generated them (first-party cookie) or sent to a different website to which they appertain (third-party cookie). In this way, the website “recognises” that this is the same user and adapts the presentation of website contents. Cookies thus “remember” your preferences, communicate how you use a site and individually adapt the displayed offerings to some extent.

Functionally Necessary Cookies

Data Processing Purpose

We shall use several functionally necessary cookies on our website. When using functionally necessary cookies, We shall process your personal data in order to provide basic functions of our website and of the services desired by you as well as to temporarily save your cookie settings. Functional restrictions would arise if these cookies would not be used. The specific purpose of the individual cookies shall follow from the table below.

Legal Basis

The legal basis for the processing of your data when using functionally necessary cookies shall be our legitimate interests in both the provisioning of a fully functional website and of the services desired by you and the temporary saving of your cookie settings (point (f) of Art. 6(1) GDPR).

Data Types, Retention Period, Recipients

The following functionally necessary cookies shall be used on our website:

Cookies

Data types

Purposes

Retention period

Recipients

supi-status

consent to the note banner

retains the consent for selected cookie categories (necessary, marketing) in the note banner

1 month

supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna

supi-allowed

consent to the individual cookies

retains information on allowed cookies

1 month

supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna

be_typo_user

user ID

notifies Typo3 whether the visitor is logged into the Typo3 back end and of the back end user type

session end

supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna

be_lastLoginProvider

user ID

contains the key of the used Typo3 back end login provider

90 days

supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna

ps_widget_token

session

serves to identify the user while using Prescreen via jobs widget

1 week

none

PHPSESSID

PHP session identifier

PHP standard session identification

session end

supseven - TYPO3-Digitalagentur, Fockygasse 29-31,1120 Vienna

Matomo Web Analysis

Data Processing Purpose

We use the “Matomo” open source web analysis tool setting not functionally necessary cookies to improve the user friendliness of our website. Then using not functionally necessary cookies and subsequently analysing the user data, We shall process personal data to learn about the preferences of our website visitors and in order to better personalise our offering. The specific purpose of the individual cookies shall follow from the table below.

Legal Basis

The legal basis for the processing of your data when using not functionally necessary cookies shall be your explicit consent (point (a) of Art. 6(1) GDPR). We shall neither set cookies for web analysis purposes nor process personal data without your explicit consent.
A given consent given may be withdrawn at any time by [enabling the withdrawal link]. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Data Types, Retention Period, Recipients

The following not functionally necessary cookies shall be used on our website for web analysis purposes:

Cookies

Data types

Purposes

Retention period

Recipients

_pk_ref

referrer URL

records the website from which you visit us

6 month

ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg

_pk_cvar

session

contains user-defined variables stipulated during the previous site view

30 minutes

ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg

_pk_id

user ID

retains a unique user ID

13 month

ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg

_pk_ses

session

displays a visitor’s active session

30 minutes

ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg

Processors

We shall call on the Matomo Cloud, operated by ePrivacy Holding GmbH, Große Bleichen 21, 20354 Hamburg, Germany, to operate Matomo. This service provider was carefully selected and meets high data protection and security standards. We shall only disseminate information necessary for the offered services to it and shall contractually obligate it to treat all information We disseminate to it as confidential and to process personal data only according to our instructions. The privacy policy for the Matomo Cloud can be found here.

This Processor shall call on a sub-processor, Amazon Web Services Inc., 410 Terry Avenue North, Seattle WA 98109, USA, to process data. Any and all data shall be processed by the sub-processor in Frankfurt, Germany. We cannot rule out nonetheless that our sub-processor will be obligated by US security authorities, for example, to disclose the data processed on the servers in Frankfurt due to its company being based in the USA. According to the European Court of Justice, the USA do not have an adequate level of data protection. We thus obligated our Processor to conclude standard contractual clauses with Amazon Web Services Inc. to ensure an adequate level of data protection and shall use this service only with your consent.

Modification of Your Cookie Settings

By making relevant browser settings, cookies will generally not be stored and/or cookies already stored will be deleted. You can block the storage of cookies in the first place or the storage of cookies by third-party providers and delete cookies already stored with all common browsers. If cookies are disabled for our website, it might no longer be possible to use all functions of the website in full.

 

Embedding of Google Maps

Data Processing Purpose

The map material of Google Maps shall be embedded to professionally display the contents of our website. We shall use this service to offer object localisation. Personal data of you shall be processed when using Google Maps.

Legal Basis

The legal basis for the data processing shall be your given consent under point (a) of Art. 6(1) GDPR.

You may consent by placing the relevant check mark in our consent banner or accessing the application retrospectively. If no consent has been given to that end, the Google Maps content shall not be loaded and thus no data shall be transmitted or retained.

A given consent given may be withdrawn again at any time by [enabling the withdrawal link below the map presentation]. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The non-granting or withdrawal of consent shall merely result in Google Maps no longer being provided.

Retention Period

We shall not retain data permanently.

Recipients

Your data shall be disseminated to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which, in turn, shall disseminate your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.

Transfer to Third Countries

Google Ireland Limited shall disseminate your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. According to the European Court of Justice, the USA do not have an adequate level of data protection. In particular, US intelligence agencies can access your data without you being notified and it being possible for you to take legal action in that respect. We thus concluded standard contractual clauses with Google LLC to ensure an adequate level of data protection and shall use this service only with your consent. Detailed information on the data processing by Google can be found at https://policies.google.com/privacy?hl=en-GB.

 

Embedding of Video Services

Data Processing Purpose

We shall process data to play back videos on our website.

The video material of YouTube shall be embedded to professionally display the contents of our website. We shall use this services to publish YouTube videos on our website. Personal data of you shall be processed when using YouTube.

Legal Basis

The legal basis for the data processing shall be your given consent under point (a) of Art. 6(1) GDPR.

You may consent by placing the relevant check mark in our consent banner or accessing the application retrospectively. If no consent has been given to that end, the YouTube content shall not be loaded and thus no data shall be transmitted or retained.

A given consent given may be withdrawn again at any time by [enabling the withdrawal link below the video]. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The non-granting or withdrawal of consent shall merely result in the YouTube content no longer being provided.

Retention Period

We shall not retain data permanently.

Recipients

Your data shall be disseminated to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which, in turn, shall disseminate your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.

Transfer to Third Countries

Google Ireland Limited shall disseminate your data to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. According to the European Court of Justice, the USA do not have an adequate level of data protection. In particular, US intelligence agencies can access your data without you being notified and it being possible for you to take legal action in that respect. We thus concluded standard contractual clauses with Google LLC to ensure an adequate level of data protection and shall use this service only with your consent. Detailed information on the data processing by Google can be found at policies.google.com/privacy.

 

Construction Site Cameras

We shall provide video material from the operation of cameras on the construction sites of CA Immo on our website, in particular to inform the interested public about the construction progress. The recordings of the construction site cameras shall be made in coarse granularity/resolution and from a great distance with the result that neither persons nor vehicles can be zoomed in and thus easily identified.

Detailed information about this data processing can be found here.

 

Newsletter

Data Processing Purpose

If you log into our website for our newsletter, We shall process the contact data specified by you (title, first name, surname, e-mail address) with your consent to send our newsletter to the specified e-mail address.

Our newsletter shall contain information in relation to our company in connection with real estate and land plot transactions, personnel changes, project developments, events and award ceremonies, stock (exchange) news, balance sheet and annual financial statements.

Legal Basis

In this case, the legal basis for the processing of your personal data shall be the consent voluntarily given by you and withdrawable at any time under point (a) of Art. 6(1) GDPR.

You may withdraw your consent and unsubscribe the newsletter at any time by clicking on the unsubscribe link contained in each newsletter e-mail. If you withdraw your consent, you shall not receive any newsletter from us.

The newsletter shall be sent as long as you have not unsubscribed the newsletter dispatch.

Retention Period

We shall keep your data until you cancel the newsletter subscription. If you unsubscribe the newsletter, this shall be noted automatically, with the result that you shall not receive any further newsletter as from the time of your unsubscription. Title, first name and surname shall then be erased within 7 days at the longest. For reasons of proof, the consent given to receive the newsletter (including e-mail address as well as subscription and unsubscription date) shall be retained longer, but shall be erased 3 years from the newsletter unsubscription at the latest.

Recipients

We shall call on a service provider (Processor) to dispatch the newsletter. mailwork - Der Direktmarketing-Partner GmbH, Am Busbahnhof 1, 24784 Westerrönfeld, shall send our newsletter by our order. To that end, We shall transfer to the company the contact data you provided.

 

Your rights

As data subject, you shall have the following rights in relation to the processing of your personal data:

Right to Withdraw Consent

Where your data is processed based on your consent, you shall be entitled to withdraw your consent at any time. We shall no longer process this data in future as from receipt of your withdrawal. The withdrawal of consent shall not affect, however, the lawfulness of processing made up to the time of withdrawal.

Right of Access

You may demand access to the data processed on your person, in particular on the origin and categories of data processed, the retention period, the recipients to whom your personal data will be or were disclosed, the purpose or nature of processing. On demand, We shall provide you with a copy of your personal data processed by us.

We point out that no access is to be granted if this results in business or trade secrets of the controller or third parties being jeopardised.

Right to Rectification

If We process inaccurate or incomplete data on your person, you may demand its rectification or completion, even by giving a complementary notice.

Right to Erasure

You shall have the right to obtain from us erasure of personal data concerning you. We will gladly erase your data to the extent provided for by law (Art. 17 GDPR).

We point out that there shall be no right to erasure, in particular, if We must process the data to meet a legal obligation or in order to establish, exercise or defence legal claims.

Right to Restriction of Processing

Where it is not clear whether the data processed on your person is inaccurate or incomplete or processed unlawfully, you may obtain from us restriction of use of your personal data.

Right to Object

Even if the data on your person is accurate and complete and lawfully processed by us, you may object to the processing of this data in particular individual cases substantiated by you. You may also object if you receive direct marketing from us and do no longer want to it in future.

Right to Data Portability

If We process personal data you provided us of you, you may obtain from us transfer of this data to you in a machine-readable format under certain circumstances. You may also engage us to directly transfer this data to a third party selected by you, where this is technically feasible.

Right to Lodge a Complaint

Even if We make best efforts to ensure the protection and integrity of your data, disagreements about the way We use your data may not be ruled out. If you take the view that your data is processed in violation of the GDPR, you shall be free to both establish contact with our data protection coordination team and lodge a complaint with the Austrian data protection authority.

Contact

Regarding all of your concerns under data protection law, in particular to assert your rights, please contact in writing (by letter or e-mail) the address specified in the legal notice. Alternatively, you may also directly address our data protection officer (dsb@caimmo.com).