Privacy Policy for tenants, prospective tenants and guarantors
This privacy policy explains how we process your personal data when you are interested in our real estate offers or rent a property from us. In addition it outlines your rights under the European General Data Protection Regulation (GDPR).
Contact details of the controller and Data Protection Officer
If you have any questions or suggestions regarding this information or if you wish to exercise your rights, please contact the data controller at:
ROBERT VOGEL GMBH
Warburgstraße 50
20354 Hamburg
Phone: +49 40 35 55 10
Fax: +49 40 34 44 23
Email: kontakt@robertvogel.de
Web: www.robertvogel.de
You can reach our data protection officer at the following contact details:
Categories of data, purpose and legal basis of processing
Prospective tenants
To schedule a viewing appointment, we process your name and contact details The legal basis for the processing is Article 6(1)(f) of the GDPR and the processing serves our legitimate interest to contact you.
If you express your intention to rent a property, additional data is collected, such as employment details, employer information, and household size. This is used to decide which applicants are suitable for a rental agreement. If a rental agreement is concluded, further data will be collected. The legal basis for the processing is Article 6(1)(b) of the GDPR and the processing is necessary for initiating the rental contract.
To assess the creditworthiness of potential tenants, and if no sufficient proof has been provided, we may obtain a SCHUFA credit report from SCHUFA Holding AG. The legal basis for the processing is Article 6(1)(f) of the GDPR and the processing serves our legitimate interest lies in verifying the reliability of future contractual partners. Further information on data protection at SCHUFA Holding AG can be found at: https://www.schufa.de/global/datenschutz-dsgvo/.
Tenants
For the establishment and execution of the tenancy, the processing of your personal master data, contract data and usage data is regularly required. Your master data include, in particular, your name, contact details, address and date of birth. Contract data include information from your rental agreement, such as your bank details or the number of adults/t. residents. Usage data include information about your consumption of gas, water, and electricity as well as possibly your heating behavior. We also process documentation data and data from advisory and service conversations. The legal basis for these processing activities is Art. 6(1)(b) GDPR.
If you have not yet concluded an electricity supply contract with an energy supplier at the time of signing the rental agreement and do not intend to register with your universal service provider yourself, we will transmit your contact details to the respective universal service provider for electricity immediately after handover of the apartment. The transfer of your data serves our legitimate interest in not having the electricity supplied by the universal service provider charged to our tenant and our interest in a smooth conduct of the tenancy. It is based on the legal basis of Art. 6(1)(f) GDPR.
Further data processing occurs only with your consent under Art. 6(1)(a) GDPR or on the basis of Art. 6(1)(c) GDPR to the extent required to fulfill our statutory obligations (e.g., commercial and tax retention obligations, § 257 HGB or § 147 AO).
Guarantors
If you act as a guarantor for a tenant's financial obligations, we process your master data (name, contact details, address, date of birth), income information (pay slips, government benefits), employment details and creditworthiness data (e.g. personal insolvency, court judgments). We may obtain credit information from agencies such as SCHUFA Holding AG. These agencies may use the data for profiling. Further information on data protection at SCHUFA Holding AG can be found at: https://www.schufa.de/global/datenschutz-dsgvo.
The legal basis for the processing is Article 6(1)(f) of the GDPR and the processing serves our legitimate interest in securing claims against the tenant.
Consequences of not providing data
The provision of master, contract, and consumption data is necessary for the establishment and execution of the rental agreement, unless we have explicitly stated otherwise when collecting this data. Without providing this data, we cannot conclude or carry out a rental contract with you.
Recipients or categories of recipients
Within our organization, only those departments that require your data to fulfill contractual and legal obligations have access to it.
We also work with data processors under Art. 28 GDPR who process data only on our instructions and may not use it for their own purposes. We work with the following categories of data processors:
- IT service providers (hosting, maintenance, support of IT/telecom systems)
- Hardware maintenance (e.g. copiers, printers)
- Document and data carrier destruction
- Billing companies and metering services services for the collection of consumption data, for the utility cost statement, and, if applicable, for providing information about your heating behavior (according to HeizKV
- Project management services
In the course of managing the tenancy, data may also be shared with: utility companies, tradespeople, janitorial and cleaning services, banks, tax advisors/auditors or tax authorities.
Data transfers to third countries
Your personal data is processed exclusively within the EU/EEA. There are no planned transfers to "third countries.
Storage duration and criteria for data retention
Prospective tenants
Your data will be deleted after the rental selection process if no tenancy is concluded – unless statutory retention obligations or legal interests in retaining the data apply.
Tenants and guarantors
Your data will be stored for the duration of the tenancy. Beyond this, it will be retained if legally required. Retention obligations arise under the German Civil Code (BGB), Commercial Code (HGB), and Tax Code (AO). Maximum retention period: 10 years (§ 257 HGB, § 147 AO). Standard limitation period: 3 years (§§ 195, 199 BGB). Data stored for marketing purposes will be deleted upon objection, unless there is a legal reason to retain it (e.g. for evidence during the limitation period).
Your rights
As a data subject, you are entitled to exercise your rights under data protection law directly against us. In particular, you have the following rights:
- Right of access (Art. 15 GDPR) – to know whether and what personal data we process about you.
- Right to rectification (Art. 16 GDPR) – to correct inaccurate or incomplete data.
- Right to erasure (Art. 17 GDPR) – to request deletion of your data.
- Right to restriction (Art. 18 GDPR) – to restrict the processing under certain conditions.
- Right to data portability (Art. 20 GDPR) – to receive your data in a structured, commonly used format and transmit it to another controller.
- Right to withdraw consent (Art. 7(3) GDPR) – to revoke consent at any time without affecting the legality of processing based on consent before withdrawal.
- Right to lodge a complaint (Art. 77 GDPR) – with a supervisory authority if you believe your data is being processed unlawfully.
Right to object
According to Art. 21(1) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR. If your data is processed for direct marketing purposes, you may object to this processing at any time in accordance with Art. 21(2) and (3) GDPR.