1. Name and contact details of the Responsible Parties

MEAG MUNICH ERGO AssetManagement GmbH is the primary party responsible for data protection on the Websites:

MEAG MUNICH ERGO AssetManagement GmbH
Am Münchner Tor 1
80805 München
Germany
info@meag.com
+49 89 / 2489-0

MEAG MUNICH ERGO Kapitalanlagegesellschaft mbH is responsible for data protection in specific areas (e.g. institutional investors):

MEAG MUNICH ERGO Kapitalanlagegesellschaft mbH
Am Münchner Tor 1
80805 München
Germany
info@meag.com
+49 89 / 2489-0

2. Contact details of the Responsible Parties' Data Protection Officer

MEAG MUNICH ERGO AssetManagement GmbH/ MEAG MUNICH ERGO Kapitalanlagegesellschaft mbH

Data Protection Officer
Am Münchner Tor 1
80805 München
Germany
Telephone number: 089- 2489-0
datenschutz@meag.com

This section applies only to our general MEAG Website (www.meag.com).

What data and data sources do we use?

HTTP data: These are log data gathered for technical reasons by the Hypertext Transfer Protocol (Secure) (HTTP(S)) when you visit our Websites. These data include the IP address, the type and version of your internet browser, the operating system used, the web pages visited, the previously visited website (Referrer URL), and the date and time of accessing our Website.

Load distribution data: These are data used to manage the distribution of traffic to our Websites. They include information about your allocation to a specific webserver. These data are stored in cookies on your device and automatically retrieved when you visit our Websites.

Search function data: These are data generated when using the search and filter functions on our Websites. They include all words that you enter as search terms on our Websites, and the filters that you select in filter functions.

Data protection settings data: These are the data protection settings you select for our Websites, including which consents you have given at what time. These data are stored in cookies on your device and automatically retrieved when you visit our Websites.

We receive these data from the users of our Websites.
 

Do you have to provide your data?

HTTP data: You are not obliged in any way to provide the data. If you do not, however, we cannot provide you with access to the contents of our Websites.

Load distribution data: You are not obliged in any way to provide the data. If you do not, however, we cannot the balance out the traffic load, which may mean that the contents of our Websites are provided to you more slowly.

Search function data: You are not obliged in any way to provide the data. If you do not, however, you cannot use the search or filter functions on our Websites.

Data protection settings data: You are not obliged in any way to provide the data. If you do not, however, we cannot use the consents you issue for our Website. This means that we may not be able to provide you with certain Website functions that require consent.

Why do we process your data and with what justification?

HTTP data, search function data, data protection settings data: To ensure the security of the IT infrastructure used to provide our Websites, in particular to find, eliminate and reliably document disturbances (e.g. DDoS attacks). To this end, data are stored temporarily in log files on our webserver and analysed automatically. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to ensure the security of the IT infrastructure used to provide our Websites, in particular to find, eliminate and reliably document disturbances (e.g. DDoS attacks).

HTTP data, load distribution data: To distribute the load when providing the contents of our Websites requested by the user. Multiple servers may be used to share the workload, in order to ensure the high performance of our Websites. The requests of different visitors to our Websites are distributed among these servers ("load balancing"). In order to be able to allocate all the requests you make within one browser session to the same server, we store the information about which server your device is allocated to for load balancing purposes in cookies on your device. The cookies and the data stored in them can be retrieved during the visit to our Websites. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to provide the contents of our Websites requested by the user with the best performance possible.

HTTP data, search function data: To provide the search and filter functions of our Websites. For this purpose, data are processed temporarily on our webserver. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to provide the search function of our Websites requested by the user.

HTTP data, data protection settings data: To provide the data protection settings functions for our Websites. Your consent is required for some functions of our Websites (e.g. for it to use certain cookie-based technologies). We provide functions for data protection settings for our Websites that enable you to issue and where necessary revoke your consents. For this purpose, information on your consents is stored on your device in cookies. The cookies and the information stored in them can be retrieved during your visit to our Websites, in order to determine which consents you have given.

Who receives your data? Are they forwarded to third-party countries and/or international organisations?

HTTP data, search function data, data protection settings data: Our hosting services provider Microsoft Azure, Microsoft Corporation One Microsoft Way, Redmond, WA 98052-6399, USA and our provider of IT and maintenance services Munich Re, Königinstr. 107, 80802 München, Germany.

Load distribution data: Our hosting services provider Microsoft Azure; Microsoft Corporation One Microsoft Way, Redmond, WA 98052-6399, USA.

No information is passed on to third-party countries and/or international organisations.
 

How long do we store your data?

HTTP data, search function data: These data are stored in server log files for no longer than 7 days, unless a security-relevant event occurs (e.g. a DDoS attack). If a security-relevant event occurs, server log files are stored until the security-relevant event is taken care of.

Load distribution data, data protection settings data: We only process these data during your visit to our Website.

Are decisions made automatically?

There is currently no automated decision-making/profiling.

This section is only for users of meag.com 

With your consent, we use web-analysis technologies on our Websites. At our Website meag.com we use the web-analysis tool Adobe Analytics.

What data and data sources do we use?

We use web analysis HTTP data. These are log files that arise in the Hypertext Transfer Protocol (Secure) (HTTP(S)) when using the web analysis tool on the Websites. They include the IP address, the type and version of your internet browser, the operating system used, the web pages visited, the previously visited website (Referrer URL), and the date and time of accessing the Websites. We receive these data from the users of our Website.

We also use web analysis user device data. These are data assigned to your device by the web analysis tool on the Website. They include a singular ID for recognising your terminal device, and also certain parameters relevant to the web analysis. We receive these data from the users of our Websites.

We use web analysis profile data that are generated by the web analysis tool used on the Websites and stored in a device-specific profile. These data include information about how you use the Websites, in particular the pages you visit, how often you visit them and how long you remain on them. They also include a singular ID for recognising your terminal device. We generate these data ourselves.
 

Do you have to provide your data?

You are not obliged in any way to provide the data. If you do not, however, we cannot perform a web analysis.
 

Why do we process your data and with what justification?

We use the data for web analysis, which enables us to analyse user activity on the Websites. When you visit the Websites, the web analysis tool gathers information on your use of the Websites and stores it in a device-specific profile. Your device is issued its own unmistakable ID, which is linked to the device's profile, so that it can be identified which device the information comes from. This ID is stored in cookies on your device. While visiting the Website, your device can be recognised using its ID. The goal of the analysis is to find out where the visitors to the Websites come from, which pages and categories they view how often and for how long. The information gained helps us to improve the Websites and have them achieve their goals (e.g. increasing the number of page views).

The legal basis for this is your consent as provided for by Art. 6 (1) (a) GDPR.
 

Who receives your data? Are they forwarded to third-party countries and/or international organisations?

The data are forwarded to our web analysis partner Adobe (Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland). As a rule the data are stored and processed within Europe (Ireland, France). For maintenance purposes, however, Adobe staff outside the EU (Switzerland, Canada, Great Britain, India or USA) can gain access to the data. Data protection levels in Switzerland and Canada correspond to those in the EU, but in Great Britain, India and the USA they do not. In these countries there is a risk of government authorities processing the data, possibly without recourse to legal remedies.
 

How long do we store your data?

Web analysis HTTP data: IP anonymisation is activated on the Websites to enable the use of the web analysis tool. This means that the IP address transmitted by the browser for technical reasons is anonymised by deleting the last octet of the IP address before it is saved. We also only process the log data during your visit to the Websites.

Web analysis device data: We store the singular ID for as long as your consent to this is valid. We only process parameters relevant to the web analysis for the duration of your visit to our Websites. We delete these data if you revoke your consent.

Web analysis profile data: We store the singular ID for as long as your consent to this is valid. We save information about your use of the Websites for 90 days from the date of their collection. We delete these data if you revoke your consent.
 

Are decisions made automatically?

There is currently no automated decision-making/profiling.

This section is only relevant for users of our general MEAG Website (www.meag.com) and our job portal (karriere.meag.com).

On our general MEAG Website (www.meag.com) you can register to receive our personalised e-mail newsletter, which covers various topics such as markets and trends, fund prices and properties for rent. You may also receive additional customer information, e.g. in the form of fact sheets or product presentations. At our job portal (karriere.meag.com) you can register for our Job Alert.

Which data and data sources do we use?

Newsletter form / information service HTTP data: Log data that are generated for technical reasons by the Hypertext Transfer Protocol (Secure) (HTTP(S)) when you click on a form for requesting/cancelling our newsletter, information service or Job Alert on the Website. The data include the IP address, the type and version of your internet browser, the operating system used, the page visited, the previously visited website (referrer URL), and the date and time of the visit. We receive these data from the users of our Websites.

Newsletter / information service subscription data: Data that we collect when you register for the newsletter / information service or Job Alert. They include the following mandatory details: E-mail address; and the following optional details: form of address, first name, last name and the topics or jobs you select, about which you wish to be informed. We receive these data from our newsletter subscribers.

Newsletter opt-in data: Log data that are generated when registering for or cancelling the newsletter / information service or Job Alert. These include the date and time of the registration, the date and time of the registration notification being sent in the double opt-in procedure, the date and time of the registration in the double opt-in procedure and the IP address of the device used for the confirmation, and the date and time of any cancellation of the newsletter or information service or Job Alert. We receive these data from our newsletter subscribers.

Newsletter tracking pixel data (does not apply to Job Alerts): Log data that are generated for technical reasons by the Hypertext Transfer Protocol (Secure) (HTTP(S)) when calling up our newsletter or information service, by means of tracking pixels in the newsletter. Tracking pixels are small graphics in HTML e-mails that enable log files of the accesses to the e-mails to be recorded and analysed. The data include the IP address, the type and version of your internet browser, the operating system used, the page visited, the previously visited website (referrer URL), and the date and time of the visit. We receive these data from our newsletter subscribers.

Newsletter / information service profile data (does not apply to Job Alerts): Data in usage profiles that we generate by analysing user behaviour in the newsletter or information service, with the use of pseudonyms or which are available to us on the basis of personal knowledge of customers or an analysis of the course of the customer relationship. These include data about the use of the newsletter or information service, in particular when it is opened up, how often it is opened up, how long the user keeps it open as well as the topics and interests relevant to the recipient. These data are generated autonomously.

Do you have to provide your data?

Newsletter / information service form HTTP data: You are not obliged in any way to provide the data. If you do not, however, we cannot provide you with the form to register or cancel our newsletter / information service or Job Alerts.

Newsletter subscription data, newsletter opt-in data: You are not obliged in any way to provide the data. If you do not, however, we cannot provide you with the newsletter / information service or Job Alerts.

Newsletter / information service tracking pixel data (does not apply to Job Alerts): You are not obliged in any way to provide the data. If you do not, however, we cannot analyse your user behaviour with regard to the newsletter.
 

Why do we process your data and with what justification?

Newsletter / information service subscription data, newsletter /information service opt-in data: "Double opt-in" procedure for confirming the subscription. In this procedure we send you an e-mail asking you to confirm the e-mail address given upon registration. A subscription does not come into effect until the subscriber confirms the e-mail address by clicking on the confirmation link in the e-mail. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in the legally valid documentation of your consent to receiving the newsletter.

To assert or defend against legal claims. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to assert or defend against legal claims.

To assert or defend against legal claims, including cooperation with non-company lawyers. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to assert or defend against legal claims.

Newsletter subscription data, newsletter opt-in data, newsletter profile data: For sending the newsletter / information service or Job Alerts to newsletter subscribers. We use the optional information provided at registration to personalise the newsletter / information service or Job Alerts and to select information relevant for the recipient. With your additional consent we customise our newsletter (but not our Job Alerts) to your personal interests, based on your use of the newsletter, our personal customer knowledge or an analysis of the course of the customer relationship. The legal basis for this is Art. 6 (1) (a) GDPR (consent).

Newsletter subscription data, newsletter opt-in data, newsletter tracking pixel data, newsletter profile data: For analysing the usage behaviour of newsletter subscribers in our newsletter and to create usage profiles using pseudonyms for the purpose of customising the newsletter (does not apply to Job Alerts). The legal basis for this is Art. 6 (1) (a) GDPR (consent).
 

Who receives your data? Are they forwarded to third-party countries and/or international organisations?

The newsletter subscription data, newsletter opt-in data, newsletter tracking pixel data, newsletter profile data are forwarded to our service partners Inxmail GmbH, Wentzingerstraße 17, 79106 Freiburg im Breisgau, and REXX systems GmbH, Süderstraße 77, 20097 Hamburg (Job Alerts) for processing. For the purpose of analyzing and personalizing our newsletter campaigns, additional recipients may be: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA as well as Seismic Software Inc, 12770 El Camino Real Suite 300 San Diego, CA 92130, USA. These companies are obliged by so-called EU standard data protection clauses to comply with a data protection standard which essentially corresponds to the European standard.

Newsletter subscription data, newsletter opt-in data may be sent to lawyers or courts of law for the purpose of asserting or defending against legal claims.

We do not forward any data to third-party countries and/or international organisations.
 

How long do we store your data?

Newsletter / information service form HTTP data: The data are saved in server-log files for a maximum of 7 days, unless a security incident occurs (e.g. a DDoS attack), in which case they are stored until the incident is taken care of.

Newsletter / information service subscription data: We save these data for as long as you are registered for our newsletter or information service and in the event of legal disputes until the end of these disputes.

For the Job Alert we store your data for up to 6 months after your cancellation.

Newsletter / information service opt-in data: We save these data for as long as you are registered for our newsletter / information service or Job Alerts. We save these data for evidentiary purposes when asserting or defending against legal claims and for a transitional period of two years from the end of the year in which you cancel your subscription, and in the event of legal disputes until the end of these disputes.

Newsletter / information service tracking pixel data, newsletter profile data (does not apply to Job Alerts): We only save these data for as long as you are registered for our newsletter.
 

Are decisions made automatically?

There is currently no automated decision-making/profiling.

This section is only relevant for users of our MEAG Website (www.meag.com).

On our MEAG Website (www.meag.com) you can contact us with contact forms.

If you contact us within the scope of a business relationship (e.g. as a customer, supplier or tenant) or as a job applicant, we may process further personal data in relation to your matter, and potentially also for other purposes. See https://www.meag.com/Datenschutzinformationen.htm for more.
 

Which data and data sources do we use?

Contact form HTTP data: These are log data that are generated for technical reasons by the Hypertext Transfer Protocol (Secure) (HTTP(S)) when you click on a contact form on the Website. The data include the IP address, the type and version of your internet browser, the operating system used, the page visited, the previously visited website (referrer URL), and the date and time of the visit.
Contact form data that you give us in contact forms on our Website. These include the data that you make available to us on the contact form on our Website. These can be, for instance: name, date of birth, address, telephone number, e-mail address and the content of your inquiry.
These data are provided by the users of the contact form.
 

Do you have to provide your data?

You are not obliged in any way to provide the data. If you do not, however, we cannot provide you with access to the contents of our Website, or process your inquiry.
 

Why do we process your data and with what justification?

Contact form HTTP data are used to provide our contact forms on our Website. To this end, data are processed temporarily on our Website. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to provide the Website contents accessed by the user. The data also serve to guarantee the security of the IT infrastructure used to provide the form, in particular to find, eliminate and properly document disturbances (e.g. DDoS attacks). To this end, data are stored temporarily in log files on our webserver, and evaluated. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to guarantee the security of the infrastructure used to provide the form, in particular to find, eliminate and properly document disturbances (e.g. DDoS attacks).

Contact form data are used to process your inquiry: If you contact us within the scope of a business relationship (e.g. as customer, supplier or tenant) or as a job applicant, we may process further data to process your inquiry or for other purposes. For more information go to https://www.meag.com/Datenschutzinformationen.html.
In as much as your inquiry pertains to a contract of which you are a contracting party, or to the execution of pre-contractual measures, the legal basis for this is Art. 6 (1) (b) GDPR (fulfilment of a contract, the contracting party of which is the person in question, or for taking pre-contractual measures at the request of the person in question). Otherwise Art. 6 (1) (f) GDPR (justified interest). In this case, our justified interest lies in being able to process your inquiry.
We also save and process these data for evidentiary purposes when asserting or defending against legal claims, including cooperating with external legal counsel. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to assert or defend against legal claims.
We also store data to meet statutory retention obligations, in particular under commercial and tax laws. Depending on the type of documents, commercial and tax law retention obligations of six or ten years may apply (§ 147 German Tax Ordinance (Abgabenordnung) (AO), § 257 German Code of Commercial Law (Handelsgesetzbuch) (HGB)). The legal basis for this is Art. 6 (1) (c) GDPR (meeting a legal obligation).
 

Who receives your data? Are they forwarded to third-party countries and/or international organisations?

Our hosting services provider Microsoft Azure, Microsoft Corporation One Microsoft Way, Redmond, WA 98052-6399, USA and our provider of IT and maintenance services Munich Re, Königinstr. 107, 80802 München, Germany receive the data. Lawyers or courts may receive the contact form data for the purpose of asserting or defending against legal claims.
 

How long do we store your data?

Contact form TTP data: The data are stored in server log files for a maximum of 7 days, unless a security-relevant incident occurs (e.g. a DDoS attack). In the event of a security-relevant incident, server log files are stored until the security-relevant incident is fully dealt with.
Contact form data: These data are stored until your matter is clarified. We store these data for evidentiary purposes or to assert or defend against legal claims, and also for a period of three years from the end of the year in which you gave us the data, and, in the event of legal disputes, until the end of these disputes. We also store these data to meet any applicable statutory, in particular commercial or tax law obligations. Depending on the type of documents, commercial and tax law retention obligations of six or ten years may apply (§ 147 German Tax Ordinance (Abgabenordnung) (AO), § 257 German Code of Commercial Law (Handelsgesetzbuch) (HGB)). If you use the contact forms for a job application or for a tenancy or business relationship, the deletion and retention periods applicable to these processing purposes apply https://www.meag.com/Datenschutzinformationen.html.
 

Are decisions made automatically?

There is currently no automated decision-making/profiling.

This section is only relevant to users of our MEAG Website (www.meag.com).

We offer the opportunity to contact us on the MEAG Website (www.meag.com) by means of a chat function. If you contact us within the scope of a business relationship with us (e.g. as customer, supplier or tenant) or as a job applicant, we may process further data to process your inquiry or for other purposes.  
You will find more on this topic at https://www.meag.com/Datenschutzinformationen.html
 

Which data and data sources do we use?

Chat function HTTP data. These are log data gathered for technical reasons by the Hypertext Transfer Protocol (Secure) (HTTP(S)) when you use the chat function. These data include the IP address, the type and version of your internet browser, the operating system used, the web pages visited, the previously visited website (Referrer URL), and the date and time of accessing our Website. The users of the chat function make these data available to us.

Chat data. Some of these are data that you give us in the dialogue with our employee when using the chat function.
They can include the following information: name, address, telephone number, e-mail address and the content of your inquiry.

Others include data that our employee gives you in the dialogue in the chat function. They can include the following information: responses to your inquiry. We generate these data ourselves.
 

Do you have to provide your data?

You are not required by law or contract to provide the data, or to conclude a contract. The person involved is not obliged in any way to provide data. If you do not provide the chat function HTTP data, however, you cannot use the chat function. In this case we cannot process your inquiry.
 

Why do we process your data and with what justification?

Chat function HTTP data: The data are processed in order to be able to provide the chat function on our Website. For this purpose, data are processed temporarily on the webserver of the chat function. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to provide the chat function.

Another purpose is to ensure the security of the IT infrastructure used to provide the chat function, in particular to find, eliminate and properly document disturbances (e.g. DDoS attacks). For this purpose, data are temporarily stored in log files on the chat function's webserver and evaluated. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to guarantee the security der IT infrastructure used to provide the chat function, in particular to find, eliminate and properly document disturbances (e.g. DDoS attacks).

Chat data: We use the data to process your inquiry. Our employees can look into the inquiry that you notify us of in the chat function by entering into a direct exchange with you. If you contact us within the scope of a business relationship with us (e.g. as customer, supplier or tenant) or as a job applicant, we may process further data to process your inquiry or for other purposes. You will find more on this topic at https://www.meag.com/Datenschutzinformationen.html. In as much as your inquiry pertains to a contract of which you are a contracting party or the execution of pre-contractual measures, the legal foundation for this is Art. 6 (1) (b) GDPR (fulfilment of a contract, the contracting party of which is the person in question, or for taking pre-contractual measures at the request of the person in question), and otherwise Art. 6 (1) (f) GDPR (justified interest). In this case, our justified interest lies in being able to process your inquiry.

We also store and process data for evidentiary purposes when asserting or defending against legal claims, also when cooperating with external legal counsel. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to assert or defend against legal claims.

We also store data to meet statutory retention obligations, in particular under commercial and tax laws. Depending on the type of documents, commercial and tax law retention obligations of six or ten years may apply (§ 147 German Tax Ordinance (Abgabenordnung) (AO), § 257 German Code of Commercial Law (Handelsgesetzbuch) (HGB)). The legal basis for this is Art. 6 (1) (c) GDPR (meeting a legal obligation).
 

Who receives your data? Are they forwarded to third-party countries and/or international organisations?

Your data are transmitted to our chat-function provider Userlike UG (haftungsbeschränkt), Probsteigasse 44-46, 50670 Cologne.

Your data may be transmitted to lawyers and/or courts of law when asserting or defending against legal claims. They are not forwarded into third-party countries and/or international organisations.
 

How long do we store your data?

Chat function HTTP data: These data are stored in server log files for no longer than 7 days, unless a security-relevant incident occurs (e.g. a DDoS attack). In the event of a security-relevant incident, server log files are stored until the security-relevant incident is eliminated and fully dealt with.

Chat data: We store the data until your matter is fully dealt with.

We store these data for evidentiary purposes or to assert or defend against legal claims and also for a period of three years from the end of the year in which you gave us the data, and, in the event of legal disputes, until the end of these disputes.

We also store these data to meet any applicable statutory, in particular commercial or tax law obligations. Depending on the type of documents, commercial and tax law retention obligations of six or ten years may apply (§ 147 German Tax Ordinance (Abgabenordnung) (AO), § 257 German Code of Commercial Law (Handelsgesetzbuch) (HGB)).

If you use the chat function for a job application or in a tenancy or business relationship, the deletion and retention periods applicable to these processing purposes apply https://www.meag.com/Datenschutzinformationen.html.
 

Are decisions made automatically?

There is currently no automated decision-making/profiling.

We use plug-ins on our MEAG Website (www.meag.com), through which you can use functionalities offered by third parties on our Website. The following third-party contents are integrated:
Google Maps and You Tube Player: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The service provider's description contains more information about the functionality:
https://developers.google.com/maps/
https://developers.google.com/youtube/iframe_api_reference.

You will find more about the provider's data processing in their data protection policy:
https://www.google.de/intl/de/policies/privacy/.

Podigee: Podigee GmbH, Schlesische Straße 20, 10997 Berlin, Germany

Podigee processes IP addresses and device information to enable podcast downloads/playbacks and to determine statistical data, such as retrieval figures. This data is anonymized or pseudonymized before being stored in Podigee's database, unless it is necessary for the provision of the podcasts.

The provision of the podcasts is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in providing users with content requested by you, such as podcasts. If a respective consent has been obtained, the data shall be processed on the basis of Art. 6(1)(a) GDPR.  the consent can be revoked at any time.

You will find more about the provider's data processing in their data protection policy:
https://www.podigee.com/de/ueber-uns/datenschutz.

1. The processing of personal data by the provider of third-party content

The third-party content on our Website is integrated using a "2-click concept". With this solution, the content in question is not activated automatically when you access our Website, but rather only when you click on the button that specifically activates the content. The activation button displays the name of the content and sometimes the third party's logo.

The 2-click solution ensures that your internet browser does not automatically connect up to the server used by the third party providing the content when you access our Website. This means that the third party cannot gather personal data from you simply because you access our Website. The content is only activated when you click on the applicable button. This then initiates a connection to the servers of the respective provider's content, and they can then collect personal data from you. Activating the content in question is comparable to clicking on a link to an external website, but with the difference that the requested content is embedded optically in our Website and does not appear in a new window/tab of your internet browser. The exchange of data that you initiate by activating and using the content only takes place between your internet browser and the servers of the content provider. So if you activate third-party content, you use a function provided by them under their responsibility, but which is embedded optically in the presentation of our Website.

When activating the content (comparable to clicking on a link to an external website), the content's provider can be sent in particular your IP address and the address (URL) of the site from which you perform the activation. Furthermore, the provider of the activated content can also receive information from cookies from the respective provider that are saved in your internet browser. The provider of the respective content can, therefore, at least receive the information that our Website was accessed at the IP address allocated to you at the time of the access, simply because you initiated the activation of that content. If you are registered with the third-party provider as a user, the provider of the content in question can normally also match the received data to your user account. We point out that we have no knowledge of the data that the provider of the content actually gathers. Nor do we have any knowledge of their reasons for processing the collected data or of any further details of the provider's data processing. In particular, we do not know if the provider in question only processes the gathered data to provide the functionality of the content (e.g. to share certain content or make a comment), or also for other purposes (e.g. to compile user profiles or personalise advertising).
 

2. Transmission of data to third-party nations without a suitable level of protection

It is possible that when using content that you have activated, personal data may be transmitted to third-party countries for which there is no adequacy resolution from the European Commission and for which no suitable guarantees are provided. There is, therefore, a risk of an insufficient level of protection for the transmitted personal data, i.e. not a protection level comparable to that of the General Data Protection Regulation. This also means that the principles for processing personal data provided for in Art. 5 GDPR may not be upheld for your personal data, and that no assertable legal rights or remedies may be available to you with regard to their processing. When you activate content, we inform you of the possible risks involved with such data transfers made without adequacy resolution or suitable guarantees. You accept these risks when you click on the button for the content in question.

3. Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter referred to as “reCAPTCHA”) on this website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to determine whether data entered on this website (e.g., information entered into a contact form) is being provided by a human user or by an automated program. To determine this, reCAPTCHA analyzes the behavior of the website visitors based on a variety of parameters. This analysis is triggered automatically as soon as the website visitor enters the site. For this analysis, reCAPTCHA evaluates a variety of data (e.g., IP address, time the website visitor spent on the site or cursor movements initiated by the user). The data tracked during such analyses are forwarded to Google.

reCAPTCHA analyses run entirely in the background. Website visitors are not alerted that an analysis is underway.

Data are stored and analyzed on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the protection of the operator’s websites against abusive automated spying and against SPAM. If a respective declaration of consent has been obtained, the data will be processed exclusively on the basis of Art. 6(1)(a) GDPR. Any such consent may be revoked at any time.

For more information about Google reCAPTCHA please refer to the Google Data Privacy Declaration and Terms Of Use under the following links: https://policies.google.com/privacy?hl=en and https://policies.google.com/terms?hl=en.

This section applies only to users of our job portal (karriere.meag.com).

At our job portal (karriere.meag.com) we offer you the opportunity to apply for a job with us using an online application form.

You will find information on how the application procedure is conducted, in particular how applications are evaluated,
how the applicant is contacted, how job interviews are held and how the applicants are evaluated and selected,
at https://www.meag.com/Datenschutzinformationen.html.
 

Which data and data sources do we use?

HTTP data: These are log files that arise in the Hypertext Transfer Protocol (Secure) (HTTP(S)) when you access the portal.
They include the IP address, the type and version of your internet browser, the operating system used, the page visited,
the previously visited website (referrer URL), and the date and time of the visit.
We receive these data from every user of the portal.

Master data that you state on the application form. These include mandatory information such as your form of address,
first name and last name, and optional information such as your date of birth.

Contact details that you state on the application form. These include the mandatory information of your private e-mail address.

Application data: Contents of your application documents that you provide on the application form or add as attachments. These include things such as the cover letter, CV, letters of reference, questionnaires, interviews, qualifications,
previous positions and desired salary. If you apply via Xing, the data from your Xing profile will be used.

Other information that you provide in the "Other information" section of the application form. These include how you found us and what language you prefer to correspond in. We receive this information from applicants.
 

Do you have to provide your data?

HTTP data: You are not required by law or contract to provide the data, or to conclude a contract. You are not obliged to provide the information, but if you do not, it is not possible to use our job portal.

Other information: You are not obliged in any way to provide the information.

All other data mentioned above: You are not obliged in any way to provide the information. However, if you do not, it is not possible to perform the application procedure, and it may not be possible for you to get a job with us.
You are not required by law or contract to provide certain types of information such as health data, religion or degree of handicap. You are not obliged to provide this information, but if you do not, it may not be possible to prepare your workplace as you require.
 

Why and on what basis do we process your data?

Job portal HTTP data: The purpose of the processing here is to provide you with our job portal and online application form.
For this purpose, data are temporarily stored and processed on our webserver. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to provide you with the contents of the job portal, and guarantee the security of the IT infrastructure used to provide our Websites, in particular to find, eliminate and properly document disturbances (e.g. DDoS attacks). To this end, data are temporarily stored in log files on our webserver and automatically evaluated. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to guarantee the security of the IT infrastructure used to provide our Websites, in particular to find, eliminate and properly document disturbances (e.g. DDoS attacks).

Master data, contact details, application data, other information: The reason for processing these data is to be able to receive your application through our online application form, and to have knowledge of the channels used for applications. You will find information on how the application procedure is conducted, in particular how applications are evaluated, how the applicant is contacted, how job interviews are held and how the applicants are evaluated and selected, at https://www.meag.com/Datenschutzinformationen.html.  Art. 88 GDPR, § 26 (1) BDSG (Decision to start an employment relationship). Art. 6 (1) (b) GDPR (fulfilment of a contract,
the contracting party of which is the person in question, or for taking pre-contractual measures at the request of that person). In as much as the data you provide include special kinds of personal information pursuant to Art. 9 (1) GDPR, for example about your health, we also base our actions on Art. 26 (3) BDSG.
 

Who receives your data? Are they forwarded to third-party countries and/or international organisations?

Our IT service provider and IT maintenance services provider Munich Re, Königinstr. 107 receives the job portal HTTP data in its capacity as order processor. Our job portal service provider REXX systems GmbH, Süderstraße 77, 20097 Hamburg receives all other data in its capacity as order processor. Data are not passed on to third-party countries and/or international organisations.
 

How long do we store your data?

Job portal HTTP data: These data are stored in server log files for no longer than 7 days, unless a security-relevant incident occurs (e.g. a DDoS attack). In the event of a security-relevant incident, server log files are stored until the security-relevant incident is eliminated and fully dealt with.

Master data and job application data: Saving the data in the context of a job application process. If your application is successful, your data will be put into your personnel file. You can find information about how long your data are stored in the information about the processing of personal staff data. If the application does not lead to a job, the applicant can consent to our storing their data for 12 months after the unsuccessful application process, so they can be considered for future positions (or until the applicant revokes their consent). Otherwise, the data are kept for 6 months after the end of the application process for evidentiary purposes and in case of having to assert or defend against legal claims, and where applicable to meet statutory retention obligations. You will find details on the storage of job application data at https://www.meag.com/Datenschutzinformationen.html.

Other data: These data are deleted when non-required data are deleted.
 

Are decisions made automatically?

There is currently no automated decision-making/profiling.

This section applies only to users of our Properties for Rent portal.

With our Properties for Rent portal we offer you the opportunity to find out about properties that MEAG offers for rent.
Tenants of a property managed by MEAG can use the portal to view and manage information about their tenancy.

You can find information on the processing of data from tenants and potential tenants at https://www.meag.com/Datenschutzinformationen.html
 

Which data and data sources do we use?

HTTP data: These are log files that arise in the Hypertext Transfer Protocol (Secure) (HTTP(S)) when you access the portal.
They include IP address, the type and version of your internet browser, the operating system used, the page visited,
the previously visited website (referrer URL), and the date and time of the visit. 

Contact details: Information that you provide at the portal, including your e-mail address, which is required.

User account data: This is information that you provide when setting up a user account. It includes your private e-mail address and a password, which are required data.

We receive all data from the users of the portal.
 

Do you have to provide your data?

HTTP data: You are not required by law or contract to provide the data, or to conclude a contract. You are not obliged to provide the information in any way, but if you do not, it is not possible to use the Properties for Rent portal/job portal. 

Contact details, user account data: You are not required by law or contract to provide the data. You are not obliged to provide the information in any way. However, if you do not, it may not be possible to conduct the application procedure or rent you a property.
 

Why and on what basis do we process your data?

Portal HTTP data: To provide our Properties for Rent portal. For this purpose, data are temporarily stored and processed on the webserver. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to provide the portal contents that you wish to see. 
To ensure the security of the IT infrastructure used to provide our Websites, in particular to find, eliminate and properly document disturbances (e.g. DDoS attacks). For this purpose, data are temporarily stored in log files on our webserver and
automatically evaluated. The legal basis for this is Art. 6 (1) (f) GDPR (justified interest). Our justified interest lies in being able to ensure the security of the IT infrastructure used to provide our Websites, in particular to find, eliminate and properly document disturbances (e.g. DDoS attacks).
Portal HTTP data, contact details, user account data: To create a user account for our portal and provide the functions of the user account. Information on the current user-account session is stored on your device in cookies. These cookies and the information they contain can be retrieved while you are using our properties for rent or job portal, in order to uphold the session. The legal basis for this is Art. 6 (1) (b): Being able to meet a contractual/pre-contractual obligation.
 

Who receives your data? Are they forwarded to third-party countries and/or international organisations?

Your data are sent to our portal services provider PROMOS consult Projektmanagement, Organisation and
Service GmbH & Co. KG, Rungestr. 19, 10179 Berlin.

They are not forwarded to third-party countries and/or international organisations. 
 

How long do we store your data?

HTTP data: Log files with connection information are stored in operating systems for 90 days. No referrer URL is logged or stored. Contact details, user account data: All data stored about the user are deleted no later than 24 hours after deletion
of the account is requested (including neighbourhood indicators and chats).
 

Are decisions made automatically?

There is currently no automated decision-making/profiling.

Social network functions and social plug-ins (LinkedIn and Youtube) are integrated into our Websites in the form of small picture icons. MEAG only embeds deactivated icons that do not make contact with the servers of these external networks when you open the MEAG Website. The buttons only become active and make a connection when you activate them by clicking on the icon, thus giving your consent to communicating with these providers. A connection is made to you when you enter your personal log-in data in the network in question.

When you do so, you leave the MEAG Websites and with it our sphere of influence. MEAG does not record which external networks you activate. The next time you access our Website, the social media plug-ins will again be provided in their inactive mode, so it is ensured that no data are sent automatically to social networks when you revisit our Website.

When you interact with the social plug-ins, for example to make a comment, the corresponding information is sent to the social network, where it is saved in accordance with that social network's guidelines. See the data protection policy of the respective social network for the purpose and scope of their data collection, how they use data and what your rights and options are in this regard.

If you access our profile page on a social network, the operator of the social network can also set cookies on your end device, regardless of whether you have an account with the network or whether you are logged in there. Cookies are data packets that mark the user's end devices with a specific identifier. Cookies are set primarily to enable us to display personalized advertising to visitors to social networks, including our profile pages. This is done, for example, by showing the user ads on social network pages from social network advertising partners whose websites the user had previously visited. Cookies also enable us to compile statistics on the use of our profile page (e.g. number of page views, user categories). If we receive such statistical analyses from the operator of the social network, the data is previously anonymised by the operator, i.e. it is not possible for us to assign usage data to an individual user.

The purpose of processing your data on our profile page with the respective social network is to inform you about our offers and services and to answer any enquiries on our profile page. The legal basis for the processing is Art. 6 (1) (f) GDPR. In this respect, public relations work is covered by our legitimate interests within the meaning of the provision. If you use a social plugin integrated by us, the legal basis is your consent according to Art. 6 (1) (a) GDPR.

Private messages that you send us via social networks will be deleted 2 years after the last communication with you. Public posts from you (e.g. in our timeline) will always remain permanently published until you explicitly request their deletion.

We have no influence on which data is collected and transmitted by the social network operator, to which third party recipients a transmission by the social network operator takes place and how long the data is stored by the social network operator. For this we refer to the privacy policy of the respective social network.

We reserve the right to delete illegal content published by users on our profile page on the respective social network, e.g. copyright infringements or statements relevant under criminal law.

In accordance with the case law of the European Court of Justice, we are jointly responsible with the operator of the respective social network for the operation of our profile page or the social plugin with regard to compliance with data protection regulations. Within this framework, the operator of the social network provides the corresponding IT infrastructure as well as the social network website and is basically the primary contact person when it comes to processing your data on the social network pages (e.g. information or deletion). However, you can also assert your legal rights against us. In this case we will forward your requests to the operator of the social network.

US providers (YouTube, LinkedIn) are transmitting to the US. By concluding so-called EU standard contractual clauses, these providers have undertaken to comply with a level of data protection that essentially corresponds to the European level.

 Please note, however, that the existence of an appropriate data protection standard for providers outside the EU / EEA – even in the case of the conclusion of EU standard contractual clauses – cannot be guaranteed in every case.

 We provide information on the following social networks:

YouTube:
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 D04 E5W5, Ireland

https://policies.google.com/privacy?hl=de&gl=de

 LinkedIn:

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2 D02 AD98, Ireland

https://www.linkedin.com/legal/privacy-policy/

 Xing:

Provider: New Work SE, Am Strandkai 1, 20354 Hamburg, Germany

https://privacy.xing.com/de/datenschutzerklaerung

Kununu:
Provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany

https://privacy.xing.com/de/datenschutzerklaerung

To make our Websites user-friendlier, more effective and safer, cookies are saved on your computer while you are online with us. Cookies are small files that manage the presentation and use of our Website. Cookies do not damage your computer in any way, nor do they contain viruses.
 

1. General information about cookies

First and third-party cookies: Cookies can be first-party or third-party cookies, depending on where they come from:
First-party cookies: Cookies placed and used by the operator of the website, or by a processing company commissioned to do so on its behalf.
Third-party cookies: Cookies placed and used by other parties responsible for processing than the operator of the website, which are not acting on the website operator's behalf.

Transient and persistent cookies: This differentiation depends on the period of validity of the cookies:
Transient cookies (session cookies) are deleted automatically when you close your browser.
Persistent cookies remain in your computer for a certain period after you close the browser.

Consent-free and consent-required cookies: Depending on their function and purpose, certain cookies can require the user's consent.
Consent-free cookies: Cookies that have the sole purpose of sending a notification through an electronic communication network, and cookies that are needed so the providers of an information service that the user has explicitly requested can make that service available to them ("required cookies").
Consent-required cookies: Cookies for all other purposes than those above.
 

2. Managing the cookies used on our Websites

Issuing and revoking consents for the use of cookies in the data protection settings of our Websites

If consent is required for a cookie to be deployed, we only do so if you have given your consent. You can find out whether a given cookie requires your consent in the information about the cookies used on our Websites in this Data Protection Information.

The first time you access our Website we display a popup for data protection settings, where you can give your consent to consent-required cookies, thus enabling them to process your personal data. You can, however, also continue using our Website without giving this consent, and we will only use cookies that do not require it.

You can view the data protection settings of our Websites at any time via the link in this document and in the footer of the Website in question. You can revoke or re-issue your consents in the data protection settings at any time.

We store which consents you have given in a (required) cookie (called a "data protection settings cookie") on your device. The data protection settings cookie is only valid for 12 months. After this period, or if you delete it beforehand, we will display the banner for data protection settings for our Websites again the next time you visit our Website.

You cannot deactivate required cookies in our Website's data protection settings, but you can deactivate them at any time in your browser settings.

Managing cookies using your browser settings

You can also manage the use of cookies in your browser settings. Different browsers offer different ways to configure their browser settings. You can find out more about this at, for instance, http://www.allaboutcookies.org/ge/cookies-verwalten/.

We must point out, however, that if you deactivate cookies in your browser, this may also affect the proper function of functions on our Websites.
 

3. Cookies used on our Websites

Name	First Party/ Third Party	Purpose and contents	Period of validity	Consent required?
Load distribution cookies
ARRAffinity, ARRAffinitySameSite	First Party	This cookie is essential for distributing traffic load for our Websites. It saves a singular ID so your visit is allocated to the same server for the entire browser session.	Transient	No
Data protection settings cookies
cookie_disclaimer_accepted (für www.meag.com)	First Party	This cookie is essential for providing the data protection functions for our Websites. It records whether and when you have issued consents to activate consent-required processing and cookies, and to determine whether we need a new consent from you when changes are made to consent-required processing and cookies.	Persistent: 12 months	No
Statistics cookies
ai_user	First Party	This cookie registers your visit by giving it a specific ID.	Persistent: 12 months	Yes
ai_session	First Party	This cookie registers your visit by giving it a specific ID.	Transient	Yes
demdex	Third Party	This cookie helps Adobe Audience Manager perform basic functions such as visitor identification, ID synchronization, segmentation, modeling, reporting, etc.	Persistent: 180 days	Yes
dpm	Third Party	This cookie helps Adobe Audience Manager perform basic functions such as visitor identification, ID synchronization, segmentation, modeling, reporting, etc.	Persistent: 180 days	Yes
Dynamics365PortalAnalytics	Third Party	Service cookie for anonymous analysis of service usage and statistical purposes.	Persistent: 90 days	Yes
Everest_g_v2	Third Party	This cookie stores information about how the end user uses the website and what advertisements the end user has seen before visiting the website	Persistent: 365 days	Yes
Marketing cookies
79f08280-5c63-4331-b04d-fb6f39afda51	Third Party	Assess Dynamics 365 Marketing leads on the basis of the interaction.	2 years	Yes
319af4c0-e197-4de9-8a9b-fe98c8a2ca04	Third Party	Dynamics 365 Marketing	Session	Yes
msd365mkttr	First Party	Collects information about visitor behavior on several websites.	Persistent: 730 days	Yes
msd365mkttrs	First Party	Collects information about visitor behavior on several websites.	Transient	Yes
Web analysis cookies (for the web analysis tool Adobe Analytics) These cookies are used by the web analysis tool Adobe Analytics to record and analyse user behaviour, in order to improve our Website
AMCV_###@AdobeOrg	Third Party	This cookie is used to identify a Unique Visitor.	Persistent: 2 years	Yes
AMCVS_###@AdobeOrg	Third Party	This cookie is used to identify a Unique Visitor.	Transient	Yes
Preferences
plyr, cache-sprite-plyr	Third Party	Video-Player	Transient	Yes
yt-player-bandwidth, yt-player-headers-readable, yt-player-bandaid-host	Third Party	Youtube video embedding	Transient	Yes
Google Maps	Third Party	Providing map function	Transient	Yes
com.adobe.reactor.data ElementCookiesMigrated	Third Party	Used in connection with the cache function on the website.	Persistent	Yes
com.adobe.reactor.data Elements.PageTitle	Third Party	Used in connection with the cache function on the website.	Transient	Yes
com.adobe.reactor.data Elements.PageURL	Third Party	Used in connection with the cache function on the website.	Transient	Yes
Third-party content cookies When you activate third-party content, you use a functionality offered by the provider of that content under its own responsibility, which is only visually embedded in our MEAG Website. The provider may employ cookies.
Third-party content cookies	Third Party	This cookie contains an anonymous user ID, in order to be able to allocate all inquiries from a single user to the same HTTP session.	Transient	Yes
Job portal cookies
sid	First Party	This cookie contains an anonymous user ID, in order to be able to allocate all inquiries from a single user to the same HTTP session.	Transient	No
Interessenten-/Mieterportal - Cookies
MYSAPSSO2	First Party		Transient	No
SAP_Session_ID_PP0_491	First Party		Transient	No
esq-alias	First Party		Transient	No
sap_contextid	First Party		Transient	No
aap_ssolist	First Party		Transient	No
sap_usercontext	First Party		Transient	No

As the person affected, you have the following rights with regard to the processing of your personal data:
 

1. Right to be informed

As the person affected, you have the right to be informed under the provisions of Art. 15 GDPR.

This means in particular that you have the right to demand confirmation from us as to whether we process personal data about you. If we do, you also have the right to be informed as to what these personal data are and the information described in Art. 15 (1) GDPR. This includes why we process these data, what categories of personal data we process and the recipients or categories of recipients to whom the personal data have been or will be disclosed (Art. 15 (1) (a), (b) and (c) GDPR).

You can find the full scope of your rights to be informed in Art. 15 GDPR, which can be found at:
http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679. 
 

2. Right to rectification

As the person affected, you have the right to have your data corrected under the provisions of Art. 16 GDPR. This means in particular that you have the right to demand immediate correction of incorrect personal data about you, and to have incomplete data about you completed.

You can find the full scope of your rights to rectification in Art. 16 GDPR, which can be found at:
http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
 

3. Right to erasure ("right to be forgotten")

As the person affected you have the right to have your data deleted under the provisions of Art. 17 GDPR ("right to be forgotten").

This means that you have the right to demand that we delete your personal data without delay, and that we are obliged to delete personal data immediately when one of the circumstances described in Art. 17 (1) GDPR arises. This can be, for instance, if personal data are no longer required for the purposes for which they were gathered or otherwise processed (Art. 17 (1) (a) GDPR).

If we have published the personal data and are obliged to delete them, we are also obliged to take appropriate measures, including technical measures, to inform other parties responsible for processing data that a person affected has demanded the deletion of all links to the personal data or copies or replications thereof (Art. 17 (2) GDPR).

The right to erasure ("right to be forgotten") does not apply if the processing is necessary for reasons described in Art. 17 (3) GDPR. This can be the case, for instance, if the processing is required to meet a legal obligation or to assert or defend against legal claims (Art. 17 (3) (b) and (e) GDPR).

You can find the full scope of your rights to erasure in Art. 17 GDPR, which can be found at:
http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
 

4. Right to limit the processing

As the person affected you have the right to restrict the processing of your data under the terms of Art. 18 GDPR.

This meant that you have the right to demand that we limit the processing if one of the prerequisites in Art. 18 (1) GDPR is met. This can be the case if you contest the correctness of the personal data. The restriction of the data processing persists in this case for as long as is needed for us to check the correctness of the personal data (Art. 18 (1) (a) GDPR). Restriction means marking stored personal data with the goal of restricting their processing in future (Art. 4 (3) GDPR).

You can find the full scope of your rights to restrict the processing of your data in Art. 18 GDPR, which can be found at: http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
 

5. Right to data portability

As the person affected you have the right to data portability under the terms of Art. 20 GDPR.

This means that you have the right to receive your personal data that you have provided us with in a structured, commonly used, digitally readable format, and the right to send these data to another Responsible Party without our obstruction if that processing is based on a consent as provided for in Art. 6 (1) (a) or Art. 9 (2) (a) GDPR or a contract pursuant to Art. 6 (1) (b) GDPR and done with the aid of automated processes (Art. 20 (1) GDPR).

You will find information on whether the processing is based on a consent as provided for in Art. 6 (1) (a) or Art. 9 (2) (a) GDPR or a contract pursuant to Art. 6 (1) (b) GDPR in the information on the legal foundations for the processing in this data protection document.

When exercising your right to data portability, you also have the right to have us directly transmit the personal data to another Responsible Party if this is technically possible (Art. 20 (2) GDPR).

You can find the full scope of your rights to data portability Art. 20 GDPR, which can be found at:
http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
 

6. Right to object

As the person affected you have the right to object to the processing of your personal data under Art. 21 GDPR. We inform you explicitly about your right to object as a person affected upon our first communication with you at the latest.

The following is detailed information on this:

• Right to object for reasons arising from the affected person's specific situation

As the person affected you have the right to object at any time to your personal data being processed, on the basis of Art. 6 (1) (e) or (f) GDPR, for reasons arising from your specific situation. This also applies to supported profiling conducted on the basis of these provisions. You will find information on whether the processing is performed on the basis of Art. 6 (1) (e) or (f) GDPR in the information on the legal foundations of the processing in this data protection information document.

If you do submit an objection for reasons arising from your specific situation, we cease processing the personal data in question, unless we can provide legitimate, mandatory reasons for the processing that outweigh your interests, rights and freedoms, or if the processing serves to assert or defend against legal claims.

You can find the full scope of your rights to object Art. 21 GDPR, which can be found at:
http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.

• Right to object to direct advertising

If personal data are processed for direct advertising purposes, you have the right to object at any time to the processing of your personal data for this purpose. This also applies to profiling if it stands in connection with direct advertising.

You will find information on whether and to what extent personal data are processed for direct advertising purposes in the information on the purposes of the processing in this data protection information document.

If you do object to the processing for direct advertising purposes, we cease processing the personal data in question for these purposes.

You can find the full scope of your rights to object in Art. 21 GDPR, which can be found at:
http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.
 

7. Right to revoke consents

If the processing is based on a consent in accordance with Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, you have the right as the person affected to revoke your consent at any time in accordance with Art. 7 (3) GDPR. The revocation of consent does not affect the legality of the processing done on the basis of the consent before it was revoked. We inform you of this before you issue your consent.

You will find information on whether processing is based on a consent in accordance with Art. 6 (1) (a) or Art. 9 (2) (a) GDPR in the information on the legal foundations of the processing in this data protection information document.
 

8. Right to complain to a supervisory authority

As the person affected you have the right to submit a complaint to a supervisory authority under Art. 77 GDPR.
The supervisory authority responsible for us is:
 

Bayerisches Landesamt für Datenschutzaufsicht

Promenade 18

91522 Ansbach
 

Postal address:

PO box 1349, 91504 Ansbach

Telephone: 0981/180093-0

Telefax: 0981/180093-800

E-mail: poststelle@lda.bayern.de
 

You can use the contact information above to exercise your rights.

The specialist terms used in this Data Protection Information document have the meanings in the General Data Protection Regulation.

You can find the definition of terms used in the General Data Protection Regulation in Art. 4 GDPR, which can be found at the link :

 http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679.

You will find detailed information on the most important terms used in this Data Protection Information document from the General Data Protection Regulation below:

• "Personal data" refers to all information relating to an identified or identifiable natural person ("person affected"). A person is considered to be identifiable if they can be directly or indirectly identified, in particular by means of allocation to an identifier such as a name, number, location data, online name or to one or more special characteristics that express the physical, physiological, genetic, psychological, financial, cultural or social identity of this natural person;
• "Person affected" refers to the identified or identifiable natural person to whom the personal data pertains;
• "Processing" refers to any process performed with or without the aid of automatic procedures, or any such series of processes in the context of personal data, such as gathering, organising, structuring, saving, adjusting or changing, retrieving, reading out, using, publication by means of transmission, disclosure or any other method, comparison or linking, restricting, deleting or destroying the data;
• "Profiling" refers to all types of automatic processing of personal data that involves the personal data being used to gather or evaluate certain personal aspects, in particular aspects relating to work performance, to assess or predict the financial situation, health, personal preferences, interests, reliability, conduct, place of domicile or change of location of the natural person;
• "Person responsible" refers to the natural or legal person, public authority, organisation or other party that decides, alone or together with others, on the purposes and ways of processing personal data. If the purposes and ways of this processing are prescribed by EU law or the law of the Member States, the person responsible, or the criteria they name, can be provided for under EU law or the law of the Member States;
• "Contractor" refers to a natural or legal person, public authority, organisation or other party, that processes personal data for the Responsible Party;
• "Recipient" refers to a natural or legal person, public authority, organisation or other party, to which personal data is disclosed, regardless of whether it is a third party or not. Public authorities that receive personal data under EU law or the law of the Member States within the scope of a specific investigation order are not considered as recipients, however. These authorities process the data in accordance with the applicable data protection regulations and the purposes of the processing;
• "Third party" is a natural or legal person, public authority, organisation or other party, except the person affected, the Responsible Party, the Contractor or the persons authorised under the immediate responsibility of the Responsible Party or Contractor, to process the personal data;
• "International organisation" refers to an organisation as defined under international law, and its subordinate offices or any other institution created by means of or on the basis of an agreement between two or more countries;
• "Third-party country" refers to a country that is not a Member State of the European Union ("EU") or European Economic Area ("EEA");
• "Special categories of personal data" refer to data from which racial and ethnic origin, political opinions, religious or ideological convictions or union membership can be determined, as well as genetic data, biometric data for clearly identifying a natural person, health data or data on the sex life or sexual orientation of a natural person.

This version of the Data Protection Information document is dated 17 May 2023.

Technical developments or changing legal and official requirements may make it necessary to adjust this information.

You can always access the latest version of this document at meag.com.