Data privacy notice
Commerz Real AG, as the responsible company for data protaction on this website, is fully committed to protecting your personal data, and complies with all applicable privacy legislation and standards. Personal data collection on this website only takes place within the necessary scope. Under no circumstances do we forward the data we collect to third parties without your knowledge or without a lawful basis. This notice gives you an overview of what data Commerz Real AG collects when you visit our website, to what purpose, and how we use the data.
I. General information on data processing
1. Scope of personal data processing
We only collect and use personal data from our users where this is necessary to provision a fully operational website and related content and services. Personal data from our users are generally only collected and used after the user has given consent. The only exception is in cases where the user’s prior consent cannot be obtained for reasons of fact and there is a lawful basis for processing the data.
2. Lawful basis for personal data processing
Insofar as we obtain the data subject’s consent to the processing of personal data, the lawful basis for personal data processing is Article 6 (1) a) of the EU General Data Protection Regulation (GDPR).
In the case of personal data processing that is necessary for the performance of a contract to which the data subject is party, the lawful basis is Article 6 (1) b) GDPR. The same applies in the case of processing operations required to perform pre-contractual tasks.
Insofar as personal data processing is necessary for compliance with a legal obligation to which our company is subject, the lawful basis is Article 6 (1) c) GDPR.
Where personal data processing is necessary in order to protect the vital interests of the data subject or of another natural person, the lawful basis is Article 6 (1) d) GDPR.
Where processing is necessary to protect the legitimate interests of Commerz Real AG or a third party, and where such interests are not overridden by the interests, fundamental rights and fundamental freedoms of the data subject, the lawful basis is Article 6 (1) f) GDPR.
3. Data erasure and retention period
Personal data of the data subject are erased or blocked as soon as the purpose for which the data were stored no longer exists. Data can be retained for a longer period in accordance with European Union or national legislation, regulations, or other requirements to which the controller is subject. Data will also be erased or blocked upon expiration of a retention period specified by legislation or regulations mentioned above, unless continued retention of the data is necessary for the conclusion or performance of a contract.
II. Provisioning of the website and generation of log files
1. Description and scope of data processing
When our website is accessed, our system automatically collects data and information from the device accessing the site.
The following data are collected:
(1) Browser type/version,
(2) Operating system used,
(3) Name and URL of the file accessed,
(4) Referrer URL (the website previously visited),
(5) Host name of the computer accessing the site (IP address),
(6) Date and time of the server query.
The data are also stored in our system’s log files. The data are not stored together with other personal data from the user.
2. Lawful basis for data processing
The lawful basis for the temporary storage of data and log files is Article 6 (1) f) GDPR.
3. Purpose of data processing
The system needs to temporarily store the IP address to allow provisioning of the website to the user’s device. For this purpose, the user’s IP address must be retained for the duration of the session. Data are stored in log files to enable the website to operate correctly. In addition, we use the data to improve the website and to safeguard the security of our IT systems. The data are not analysed for marketing purposes.
Data processing for these purposes is in our legitimate interests in accordance with Article 6 (1) f) GDPR.
4. Data storage period
Data are erased as soon as their storage is no longer necessary to achieve the purpose for which they were collected. With respect to data collected in order to provision the website, this is the case when the corresponding session ends. With respect to data storage in log files, this is the case after seven days at the latest. Data in log files may be stored for a longer period. In this case, users’ IP addresses are erased or anonymised so that data can no longer be associated with the client accessing the website.
5. Objection and prevention
The collection of data in order to provision the website and the storage of data in log files are absolutely necessary to operate the website correctly. For this reason, it is not possible for users to object hereto.
III. Contact
1. Description and scope of data processing
Commerz Real AG offers you the opportunity to use the website to obtain information on various topics or to make contact with us. You can contact Commerz Real AG using the contact form or by telephone. When you make contact with us, we collect data such as your given and surname, your e-mail address or your phone number.
Users can also contact us using the e-mail address provided. In this case, the user’s personal data transferred via the e-mail are stored.
Data collected in this context are not generally forwarded to third parties. The data are used exclusively for the purpose of processing the conversation. If the inquiry relates to the activities of the Commerz Real AG or our subsidiaries or affiliates or companies on whose behalf the Commerz Real AG or affiliates is acting, and if necessary for the efficient processing of the inquiry, your data may be forwarded to the relevant company.
2. Lawful basis for data processing
Where the user’s consent has been obtained, the lawful basis for data processing is Article 6 (1) a) GDPR.
The lawful basis for the processing of data transferred via an e-mail is Article 6 (1) f) GDPR. If contact is made with the intention of concluding a contract, the lawful basis for data processing is additionally Article 6 (1) b) GDPR.
3. Purpose of data processing
The processing of data from entry fields is solely for the purpose of processing your initial contact. Where you initially contact us by e-mail or telephone, it is also in our legitimate interests to process your e-mail address or telephone number, respectively.
4. Data storage period
The data are erased as soon as they are no longer required for the purpose for which they were collected. For personal data entered via the fields of the contact form and data submitted to us via e-mail, this is when the conversation with the user is concluded. The conversation is deemed to have been concluded where it can be inferred from the circumstances that the issue in question has been fully resolved.
5. Objection and prevention
The user may at any time withdraw consent to the processing of their personal data. If a user initially contacts us via e-mail, they can object to the storage of his or her personal data at any time. In this instance, the conversation cannot be continued and all personal data stored within the scope of the conversation are erased.
IV. Use of cookies
1. Description and scope of data processing
Our website makes use of cookies at multiple points. Cookies are small text files that your browser stores on your device. They are employed, for example, to determine how many users visit the website and how often it is used, in order to improve the website’s user-friendliness and effectiveness. Both session cookies, which are only stored temporarily while you are using the website, and persistent cookies are used. A persistent cookie is limited to an identification number in order to gain information on users who visit the website more than once, in order to recognise you as a user and possibly to offer you improved navigation features. Cookies do not cause any damage to your device and do not contain viruses. You can prevent the storage of cookies by choosing corresponding browser settings. If you do not accept cookies, this may limit the function/operation of the website.
We use cookies on our website that allow the analysis of users’ surfing behaviour.
As a result, the following data may be transferred:
(1) Search terms entered
(2) Devices
(3) Website access frequency
(4) Time spent on a website
(5) Use of website functions
User data obtained by these means are pseudonymised by technical mechanisms. As a result, it is no longer possible to link the data to the user accessing the website. The data are not stored together with other personal data relating to the users.
When users access our website, a banner informs them of the use of cookies for analytics purposes, and they are referred to this data privacy notice. They are also told how to prevent the storage of cookies via their browser settings.
2. Lawful basis for data processing
The lawful basis for personal data processing in conjunction with cookie use is Article 6 (1) f) GDPR.
3. Purpose of data processing
Analytics cookies are employed for the purpose of improving website quality and content. Analytics cookies allow us to discover how the website is used, enabling us to continuously improve our content and offering.
The following cookies may be used on our website:
| Name | Vendor | Retained | Purpose |
| Adform-Cookie | site.adform.com | Dauer der Kampagne – bis 30 Tage | |
| _ga | google.com | 2 Jahre | Wird zur Unterscheidung der Benutzer verwendet |
| _gid | google.com | 24 Stunden | Wird zur Unterscheidung der Benutzer verwendet |
| _gat | google.com | 1 Minute | Wird zum Drosseln der Anforderungsrate verwendet |
| AMP_TOKEN | google.com | 30 Sekunden bis 1 Jahr | Wird zum Abruf der Client ID verwendet |
| _gac_<property-id> | google.com | 90 Tage | Enthält kampagnenbezogene Informationen für den Benutzer. |
| __utma | google.com | 2 Jahre | Wird zur Unterscheidung der Benutzer und Sitzungen verwendet |
| __utmt | google.com | 10 Minuten | Wird zum Drosseln der Anforderungsrate verwendet |
| __utmb | google.com | 30 Minuten | Wird zur Bestimmung neuer Besucher/Sitzungen verwendet. |
| __utmc | google.com | Session | Wird zur Bestimmung, ob der Benutzer sich in einer neuen Sitzung / einem neuen Besuch befand, verwendet. |
| __utmz | google.com | 6 Monate | Speichert die Zugriffsquelle oder Kampagne, die erläutert, wie der Nutzer die Website erreicht hat |
| __utmv | google.com | 2 Jahre | Wird zum Speichern benutzerdefinierter Variablendaten auf Besucherebene verwendet. |
Used to store visitor-level custom variable data.
Data processing for these purposes is also carried out in our legitimate interests in accordance with Article 6 (1) f) GDPR.
4. Storage period, objection and prevention
Cookies are stored on the user’s device and from there they are transferred to our website. You as the user therefore have complete control over the use of these cookies. By changing your browser settings, you can disable or restrict the transfer of cookies. Cookies already saved on your device can be erased at any time. This can also be performed automatically. If cookies for our website are disabled, it may not be possible to use all functions of our website.
V. Web tracking
Web monitoring technologies are employed on our website to collect and store data in pseudonymised form exclusively for the purpose of improving our website and its content. These data are used to create pseudonymised usage profiles. To this end, cookies may be deployed, but these collect and store data exclusively in pseudonymised form. The data are not used to personally identify visitors to this website and are not combined with personal data on the person (orthonym) behind the pseudonym.
You can configure your browser to notify you when cookies are about to be placed on your device, enabling you to decline their use. Moreover, you can prevent the installation of cookies via a corresponding browser setting. However, in this case, you may not be able to use all functions of our website. No personal data are stored. The user’s IP address is masked and does not allow conclusions to be drawn regarding visitors to this website. The lawful basis for data processing is the legitimate interests of Commerz Real AG in accordance with Article 6 (1) f) GDPR. Insofar as personal data are processed, the lawful basis is your consent in accordance with Article 6 (1) a) GDPR.
Management of tracking services:
The following tracking services are currently employed:
Use of Google Analytics - Google Analytics deaktivieren
Further information on the use of tracking technologies is given below.
Use of Google Analytics
Our website uses Google Analytics, a web analytics service provided by Google Inc. Google Analytics uses cookies, i.e. text files placed on your device, that enable an analysis of your use of the website. Generally, the information generated by the cookie about your use of the website is transferred to and stored by Google on servers in the United States. Our website uses the extension “anonymizeIp”, which activates IP anonymisation on this website. Use of this extension means, however, that Google truncates your IP address before transferring it within Member States of the European Union or other states party to the Agreement on the European Economic Area.
Google will only use this information on our behalf to evaluate your use of the website, compile reports on website activity and provide the website operator with further services related to website and Internet usage. The truncated IP address transferred by your browser within the scope of Google Analytics will not be associated by Google with any other data. You can prevent the storage of cookies by selecting the corresponding browser setting. However, please note that if you do so, it may not be possible to use all functions of our website.
You can prevent Google Analytics from collecting data by clicking the following link Google Analytics deaktivieren . An opt-out cookie is placed on your computer that prevents the future collection of your data when you visit this website.
Further information is available from Google’s Privacy Policy.
Social plugins
Our website enables visitors to use social plugins from the following companies:
Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA;
Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA;
LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA;
YouTube LLC 901 Cherry Ave, San Bruno, CA 94066. USA;
We implement plugins using the Shariff solution, which helps protect your data and prevents data collection when you visit our website. The plugins are displayed on our site simply as graphics that enable a link to the website of the social plugin provider. This prevents the direct transfer of data to this provider. By clicking on the graphic, you are forwarded to the corresponding service and only then are your data sent to the social networks mentioned above.
Further information on the Shariff solution is available here (in German only).
Security
Commerz Real AG cannot accept responsibility for the security of data transferred via the Internet. E-mail messages are not encrypted. As a result, it is not possible to rule out third parties becoming aware of them. We therefore recommend sending confidential information by conventional post only.
Your rights and how to lodge a complaint
You have the following rights with respect to our collecting and processing your personal data:
Right of access,
Right to rectification or erasure,
Right to restriction of processing,
Right to withdraw consent,
Right to object to processing,
Right to data portability.
To exercise your rights, please contact the data protection officer at Commerz Real AG at datenschutzbeauftragter(at)commerzreal.com.
In addition, you have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.
VI. Our presence on social media platforms (e.g. fan pages)
1. Scope of data collection and storage
Data generated by user interactions, such as posts, likes, etc., are employed to process user communications on social media. Cookies, demographic data and statistics on user interactions are leveraged for targeted advertising. Demographic data are based on age, place of residence, language and gender, for instance. Statistics are processed in aggregated form, which means it is impossible to identify specific individuals from the data. Examples are page activity, page visits, page previews, likes, recommendations, comments, videos, subscribers/followers including where users subscribed or followed, and time of day.
To run the social-media services, such as our Facebook fan pages and our presence on Twitter, LinkedIn, Xing and Kununu, the platform operators generally store cookies on the user’s device. These include session cookies that are deleted when the browser is closed, and permanent cookies that remain on the device until they expire or are deleted by the user. When a website is visited, a cookie is stored in a text file on the computer and retrieved and read the next time the web server is accessed. You, the user, can enable, disable or delete cookies via your browser settings. You will find instructions for your browser here: Internet Explorer, Firefox, Google Chrome, Google Chrome mobile, Microsoft Edge, Safari, Safari mobile. Alternatively, you can install ad blockers such as Ghostery.
2. Information on our presence on social media platforms
Facebook
According to Facebook, it uses cookies for the following purposes: authentication, security, site and product integrity, advertising and measurement, site features and services, performance, analytics and research. You will find details on Facebook cookies (e.g. name, expiration, contents and purpose) by following the links provided here: https://www.facebook.com/policies/cookies/. You can also disable Facebook cookies on this page. In addition, you can edit your ad preference settings. And you can change your privacy settings here: https://www.facebook.com/help/193677450678703?helpref=related
Twitter
According to Twitter, it uses cookies mainly for the following purposes: authentication and security, to record settings, for statistics and research, personalized content, advertising, and personalization across devices. You will find further details on Twitter cookies, in particular, how you can personalize your privacy settings, here: https://help.twitter.com/en/rules-and-policies/twitter-cookies
LinkedIn
According to LinkedIn, it uses cookies primarily for the following purposes: authentication, security, preferences, features and services, advertising, performance, analytics and research. You will find further details on Twitter cookies at https://www.linkedin.com/legal/cookie-policy. To learn how to manage cookies, visit https://www.linkedin.com/help/linkedin/answer/62931?trk=microsites-frontend_legal_privacy-policy&lang=en
Xing
According to Xing, it uses cookies, pixels and similar tracking technologies to enable the provision of Xing services, for the analysis of user behaviour, for the measurement and optimisation of advertising, and for statistical purposes. In addition, please be aware of the following information: When Xing measures user behaviour in order to provide the service and improve the user experience, information is associated with the user’s ID upon analysis. This may also include approximate geo-localisation. You will find further details on Xing cookies here: https://privacy.xing.com/en/privacy-policy/information-we-automatically-receive-through-your-use-of-xing; https://privacy.xing.com/en/privacy-policy/information-we-automatically-receive-through-your-use-of-xing/how-does-tracking-work. For instructions on how to modify tracking settings, visit: https://privacy.xing.com/en/privacy-policy/information-we-automatically-receive-through-your-use-of-xing/determination-of-statistics/tracking-in-embedded-external-content
Kununu
Kununu is a subsidiary of Xing. Its website provides a link to Xing’s site for information on responsibility and privacy: https://privacy.xing.com/en/privacy-policy. Please refer to the earlier section on Xing.
3. Objecting to the use of cookies
Via the following opt-out link (for the providers listed), you can also object, at any time, with effect for the future to the use of the cookies described above to collect and store data: http://www.youronlinechoices.com/uk/your-ad-choices.
You can manage your online behavioural advertising preferences via the above link. If you use this preference manager to opt out of online behavioural advertising by a specific provider, your opt-out only applies to the corresponding data capture via the web browser you are using. Preferences are managed via cookies. If you delete all browser cookies, the preferences you have selected will also be lost.
4. Facebook Insights
We use the Facebook Insights tool for statistical analysis. The tool provides us with anonymised data on the users of our Facebook fanpage. It is not possible for us to discover any personal information about you from the data. For further details, please refer to Facebook’s cookie policy.
5. Youtube
We aim to offer you broad and varied multimedia content. To this end, we embed videos from YouTube (YouTube LLC, 901 Cherry Ave. San Bruno, CA 94066 USA) into our sites.
Videos are embedded in privacy-enhanced mode or with the no-cookie option enabled. That means YouTube only places cookies and pixel tags on your computer to personalize ads and search results when you play the video.
When you play the video, the following data are transmitted to Google, which operates YouTube:
Your IP address;
The specific address of the page accessed on our site;
The browser ID transmitted;
The system date/time of access, and
Pre-existing cookies that can be used to uniquely identify your browser.
Processing of the above types of data is the sole responsibility of Google. Further information is available here.
Please be aware that Google may obtain other data via cookies previously placed on your computer. We have no influence over Google’s use of such data.
You will find YouTube’s privacy policy here.
6. Forwarding and use of personal data
Platform operators
If you interact with us on a social media platform, the platform’s operator automatically has access to your data. This applies to the following companies: Twitter, Inc., 1355 Market Street #900, San Francisco, California 94103, USA; Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA; LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA; YouTube operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; XING SE, Dammtorstrasse 30, 20354 Hamburg, Germany
Platform operators may be located in an unsafe third country that has a lower level of data protection. However, the providers of the platforms in question state that they operate in accordance with the EU-US Privacy Shield Agreement, which guarantees an adequate level of data protection in accordance with European standards.
You can view existing EU-US Privacy Shield certification at https://www.privacyshield.gov/list. Commission Implementation Decision (EU) 2016/1250 of 12 July 2016 recognises that the EU-US Privacy Shield ensures a level of protection of personal data that is essentially equivalent to that guaranteed within the European Union.
The providers of Xing and Kununu (both operated by XING SE, Dammtorstrasse 30, 20354 Hamburg, Germany) state if data processing takes places in the USA, they take care that it is performed in line with the requirements of Privacy Shield certification and that they will continue using the Commission’s standard data protection clauses in many cases.
VII. Responsibility (data controller)
The data controller under GDPR and other national data-protection legislation of member states and other related regulations is:
Commerz Real AG
Friedrichstrasse 25
65185 Wiesbaden, Germany
E-mail: cr@commerzreal.com
VIII. Data protection officer
Commerz Real AG
Data Protection Officer
Friedrichstrasse 25
65185 Wiesbaden, Germany
E-mail: datenschutzbeauftragter@commerzreal.com