In this notice we tell you about the processing of your personal data as part of your contractual relationship with us, as well as about the rights to which you are entitled under the EU's General Data Protection Regulation (or GDPR), which came into effect on 25 May 2018.
We collect and process your personal data which we have obtained
for providing advice, for promotional purposes, for the purpose of concluding and processing purchase, lease, agency, service or other contracts, for the implementation of property projects, for settling claims, for performing maintenance, repair, servicing and improvement work.
Processing is performed for a specific purpose, taking into account the provisions of the GDPR, the Austrian Data Protection Act (DSG) and all other applicable laws.
We are the "controller" for the processing of your personal data within the meaning of the GDPR:
GRAWE Immo Holding AG
Jungferngasse 10, 8010 Graz
Tel.: +43 316 8037 – ext. 6219
For questions regarding the processing of your data, please contact the privacy officer via post using the aforementioned address FAO the "privacy officer" or via email at the address firstname.lastname@example.org
For contract fulfilment in relation to the conclusion, processing and implementation of lease contracts, we make use of the subsidiary company entrusted with property management cited below which is legally instructed / has been contractually obligated as a service provider / order processor to perform the processing of your personal data in accordance with the requirements of national and European regulations and to ensure adequate protection of your rights.
GRAWE Immobilien Verwaltungs GmbH
Glacisstraße 69/EG, 8010 Graz
Tel.: +43 (0)316 832339 – 0
Which personal data do we use?
We process the data stipulated by you in forms (voluntary disclosures, offers, etc.) and contractual texts (lease, agency, purchase, service or other contracts) or in general written communication, data from third parties (employers, estate agents, etc.) and data from public registers. This includes, for example, your name, date of birth, address, information regarding payments, lease amounts, contract duration, etc.
In the event of any damage, we also collect and process your details regarding the instance of damage (e.g. damage date, cause of damage, colour photographs). If necessary, these may also be the details of third parties commissioned with assessing the service (e.g. appraisers), who can provide information in this regard (authorities, witnesses, etc.) or who are involved in service provision (craftsmen, tradesmen, etc.). The same applies to the performing of maintenance, servicing, repair and improvement work.
We only collect the data required. In other words, in some cases even less data than that mentioned above will suffice.
For what purpose and on which legal basis is data collected and used?
a) contract initiation and promotional purposes (legal basis: Art. 6, Para. 1, lit. a of the GDPR)
Provided you have explicitly declared your specific, express and voluntary consent, we will also process your personal data for promotional purposes.
The granted consent can be revoked at any time.
b) Contract management and fulfilment (legal basis: Art. 6, Para. 1, lit. b of the GDPR)
When you send an offer, a self-disclosure form or some other contractual text to us, we require those details to make a decision on the conclusion of a contract or for assessing the risk to be assumed by us in the event of such a contract.
If a purchase, service, lease/rental, agency or other contract comes into effect, we process this data for executing the contractual relationship; e.g. for lease invoices, operating cost invoicing, dealing with instances of damage, maintenance, servicing, repairs or improvements, etc.
In instances of damage or when performing maintenance, servicing, repair and improvement work, we will process additional details regarding these cases in order to be able to assess the scope and amount of our obligations.
The conclusion and execution of purchase, service, lease/rental, agency or other contracts is not possible without processing your personal data. If you do not supply us with this data, or do not do so fully, then we may not be able to justify the contractual relationship desired by you or to assess and settle claims from this contractual relationship.
c) Processing based on legal obligations (legal basis: Art. 6, Para. 1, lit. c of the GDPR)
We process your personal data to fulfil statutory obligations, such as the fulfilment of business and tax record-keeping obligations.
c) Processing based on legitimate interests (legal basis: Art. 6, Para. 1, lit. f of the GDPR)
Your personal data is processed to safeguard our legitimate interests (e.g. you are our lessee/customer or are providing us with a service; perhaps for the purpose of performing direct advertising, etc.)
To whom do we transmit data?
If required or legally prescribed for achieving the aforementioned purposes, we will only transmit the data necessary for the individual case to the recipient involved. Depending on the specific case, this may be the following:
a) (Subsidiary) companies within the group structure:
For contract fulfilment (property management, processing instances of claims, maintenance, servicing, repair or improvements), we make use of subsidiary companies within the group.
For executing damage, maintenance, servicing, repair or improvement measures, it may be necessary to send data to commissioned tradesmen. In such cases, only the data necessary in the specific case in question is communicated.
c) Designers and building contractors:
For implementing property projects, it may be necessary to send data to designers and building contractors. In such cases, only the data necessary in the specific case in question is communicated.
In certain cases, exchanging data with insurance companies may be necessary for resolving instances of damage, for example; e.g. household insurance, etc. In such cases, only the data necessary in the specific case in question is communicated.
e) Authorities, courts and other third parties:
It may be that we have to disclose the personal data of our contractual partners to authorities, courts and legal representatives upon their request as part of contract execution or in the case of any claims that need to be asserted from purchase, service, lease/rental, agency or other contracts.
When checking a damage, maintenance, servicing, repair or improvement case, it may be that we call on third parties – such as appraisers or companies commissioned with claim settlements – and send them personal data.
Where is data stored? Is data sent to recipients in third countries?
The data processed as part of our operational activity is stored in our intragroup computer centre in Graz.
If we send personal data to recipients outside the European Economic Area (EEA), transmission will only take place if the third country is confirmed by the EU Commission as having an appropriate level of data protection or other appropriate data protection guarantees are in place (e.g. binding in-house data protection regulations or EU standard contractual clauses).
How long is data stored?
As a rule, we store your data for the duration of our contractual relationship. We are also subject to statutory retention obligations, according to which we are to store your personal data, data regarding third parties, cases of damage, maintenance, servicing, repairs or improvements and regarding your contractual relationship beyond the termination of that contractual relationship. Related verification and retention obligations are imposed by the Austrian Commercial Code and the Austrian Federal Fiscal Code, amongst other sources.
Furthermore, we will store your data for as long as it is possible for legal claims to be asserted from our contractual relationship with you. General legal statues of limitation are between 3 and 30 years.
To which rights are you entitled as a data subject under data protection law?
As per articles 15 to 22 of the GDPR, you have the following rights as a data subject with respect to the controller in relation to the personal data stored about you.
If processing is based on consent, as a data subject you have the right to revoke your consent at any time. This has the result of us no longer being allowed to process your data – unless another reason exists for lawful processing. Such a revocation does not affect the legality of any processing that has taken place based on the consent up to the point of revocation.
The data subjects must identify themselves and contribute towards identification in order to ensure that the response is actually addressed to the data subject.
If you are of the opinion that the processing of your personal data has not been performed legally, you have a right of complaint to the Austrian Data Protection Authority as the supervisory authority.
GRAWE Immo Holding AG
T +43 316 8037-0
GRAWE Immobilien Verwaltungs GmbH
T +43 316 832339
STIWOG Immobilien GmbH
T +43 316 377777
Immo-Pro Immobilien GmbH
T +43 512 348334
Protop Immobilien GmbH
T +43 5372 61819
Kanzlei Silber GmbH
T +43 662 876660
RIS Realitäten- & Investitionsservice GmbH
T +43 316 832339
GRAWE nekretnine d.o.o. Beograd
Bulevar Mihajla Pupina 115 D
T +381 11 2608631
GRAWE nekretnine d.o.o. Sarajevo
Trg solidarnosti 2
T +387 33 772 534
GRAWE nekretnine d.o.o. Banja Luka
I Krajiškog korpusa 39
RS-BIH-78000 Banja Luka
T +387 51 222-960
GRAWE Nedviznosti dooel Skopje
T +389 3109-673
GRAWE Imoti dooel Skopje
Bulevar 8-mi septemvri no. 16
T +389 5116-503
GRAWE Imoti EOOD
Boulevard Vitosha 19
T +359 (2) 989 00 44
Kastély utca 2. A-B.
T +36 72 434 082
GRAWE Facility Management SRL
Strada Vulturilor Nr. 98 A, Sector 3
T +4 021 312 60 03