Data protection

Privacy Policy

We are delighted that you are visiting our website. The protection and security of your personal information when using our website is very important to us. We would therefore like to take this opportunity to inform you about which of your personal data we collect when you visit our website and for what purposes it is used. Personal data refers to specific details regarding the personal or factual circumstances of an identified or identifiable natural person (data subject), e.g. name, address, email addresses, user behaviour. This therefore refers to data that enables us to identify you. In addition, you will also find some information here regarding data processing activities outside this website (e.g. video conferences or newsletters).

Responsible for Data Processing

Data controller

For the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR) 

Volksheimstätte eG Wohnungsbaugenossenschaft
Kasseler Landstr. 89
37081 Göttingen
Telefon: 0551 / 37077 - 0
E-Mail: vh[at]volksheimstaette.de

Data Protection Officer

exkulpa gmbh
Waldfeuchterstr. 266
52525 Heinsberg
Phone: 02452 / 99 33 11
Email: datenschutz[at]volksheimstaette.de

General Information

In addition to the data you actively provide to us on this site (e.g. via our contact form), we collect certain technical data. This so-called metadata is automatically transmitted from your computer to our servers as soon as you visit our website (including browser, operating system or timestamp). We use this data to ensure our website is displayed correctly. In addition, we may collect data via integrated third-party providers (e.g. for external media such as map services or analytics tools). We will explain the specific purposes and legal bases in the course of this privacy policy.

Retention period

Unless a specific retention period is stated within this privacy policy, we will retain your personal data for as long as the purpose of the data processing remains valid. If you submit a valid request for erasure or withdraw your consent, we will delete your data. Statutory retention obligations remain unaffected.

Legal basis for data processing

If you have consented to data processing, the processing of your personal data is based on Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, if special categories of data are processed in accordance with Article 9(1) of the GDPR. Where you have given your express consent to the transfer of personal data to third countries, the data is also processed in accordance with Article 49(1)(a) of the GDPR. If you have consented to the storage of cookies or access to information on your device (e.g. through device fingerprinting), data processing also takes place on the basis of Section 25(1) of the TDDDG. Your consent may be withdrawn at any time. If your data is necessary for the performance of a contract or for the implementation of pre-contractual measures, we process your data in accordance with Article 6(1)(b) of the GDPR. Furthermore, we process your data where this is necessary to comply with a legal obligation, on the basis of Article 6(1)(c) of the GDPR. Data processing may also take place on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR. The following sections of this privacy policy provide information on the respective legal bases in individual cases.

Note on data transfers to third countries and US companies without DPF certification

Please note that we use tools from companies based in third countries with insufficient data protection standards or in the USA, which are not covered by the EU-US Data Protection Framework (DPF). When using these tools, your personal data may be transferred to and processed in these countries. Please note that in these third countries, a level of data protection comparable to that of the EU cannot be guaranteed.

We would like to clarify that the US generally offers a level of data protection comparable to that of the EU. The transfer of data to the US is permitted if the recipient holds DPF certification or provides appropriate additional safeguards. Information on data transfers to third countries, including data recipients, can be found in our privacy policy.

Automated decision-making

Your personal data is not processed for the purposes of automated decision-making.

Your rights

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:

  • Right of access: You have the right to request confirmation from us as to whether your personal data is being processed and, if so, to receive further information about the processing and copies of the data being processed (Art. 15 GDPR).
  • Right to rectification: You have the right to request the immediate rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete personal data (Art. 16 GDPR).
  • Right to erasure: You have the right to request the immediate erasure of personal data concerning you where the legal conditions are met, in particular where the data is no longer necessary for the purposes for which it was collected and the processing is unlawful (Art. 17 GDPR).
  • Right to restriction of processing: You have the right to request that we restrict the processing of your personal data where the legal conditions are met, in particular where you contest the accuracy of the data, the processing is unlawful and you oppose erasure (Art. 18 GDPR).
  • Right to data portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided this is technically feasible (Art. 20 GDPR).
  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, where the processing is based on Article 6(1)(e) or (f) of the GDPR (Article 21 of the GDPR).
  • Right to withdraw consent: You have the right to withdraw your consent to the processing of personal data at any time with effect for the future. Withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to withdrawal (Art. 7(3) GDPR).
  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Article 77 GDPR).

Further data processing operations

General information obligations

This information is intended for customers, prospective customers, suppliers and employees. We process your personal data for the following purposes:

  • To fulfil our contractual obligations to you (Art. 6(1)(b) GDPR).
  • To carry out pre-contractual obligations (Art. 6(1)(b) GDPR).
  • To respond to enquiries (Art. 6(1)(b) GDPR).
  • Where you have given us your consent to process your personal data for specific purposes (such as to receive our newsletter), data processing takes place on the basis of your consent (Art. 6(1)(a) GDPR).
  • To comply with legal obligations to which our company is subject (Art. 6(1)(c) GDPR).
  • Where necessary, we also process your data to safeguard our legitimate interests, in particular to assert legal claims and defend ourselves in legal disputes, or to ensure IT security; to consult and exchange data with credit reference agencies to assess creditworthiness and default risks; for direct marketing and market research, provided you have not objected to the use of your data for this purpose; in connection with measures for business management and the further development of services and products, in connection with measures for product and sales optimisation, in connection with risk management measures, and for the prevention or investigation of criminal offences (Art. 6(1)(f) GDPR).
     

Categories of recipients of personal data

Within our company, only those employees who absolutely need the data to perform their duties have access to it (need-to-know principle). Individual processes and services are carried out by carefully selected service providers, commissioned in accordance with data protection regulations, who are based within the EEA. Where service providers commissioned by us gain access to personal data whilst performing their services, data processing agreements have been concluded with them in accordance with Article 28(3) of the GDPR.

Duration of data storage

The data we process is stored for the duration of the contractual relationship and its fulfilment, and in compliance with statutory retention periods. These include, in particular, commercial and tax law retention obligations under the German Commercial Code (HGB) and the German Fiscal Code (AO). The standard retention and documentation periods amount to up to ten years. If no contractual relationship is established, we process the data only for as long as the specific purpose requires.

Credit checks by infoscore – information pursuant to Article 14 of the GDPR

Our company regularly checks and monitors information regarding your previous payment history when contracts are concluded and, in certain cases where there is a legitimate interest, also for existing customers. To this end, we work with infoscore Consumer Data GmbH, Rheinstrasse 99, 76532 Baden-Baden, from whom we obtain the necessary data. For this purpose, we transfer your name, address and date of birth to infoscore Consumer Data GmbH. The information pursuant to Article 14 of the EU General Data Protection Regulation regarding the data processing carried out by infoscore Consumer Data GmbH can be found here: https://www.experian.de/icd-infoblatt.

Cookies

Cookies are small text files that are stored by your browser on your device to save certain information whilst you are using the website. Cookies enable us to improve various aspects of our website and make your visit more convenient.

There are various types of cookies, each serving different purposes. Temporary cookies, also known as session cookies, are stored only for the duration of your use of the website and are automatically deleted when you close your browser. Persistent cookies, on the other hand, remain stored on your device for a longer period and enable us to recognise you and your preferences when you visit the website again.

Cookies can also be divided into first-party cookies and third-party cookies. First-party cookies are set by our website, whilst third-party cookies are set by other websites or service providers whose content is integrated into our website, such as plugins or analytics tools.

Cookies are used for various purposes, such as ensuring the website functions properly, storing user settings, compiling anonymous statistics on user behaviour, or displaying personalised content and advertising. The legal basis for the use of cookies varies depending on the purpose of the cookies. In some cases, the setting of cookies is based on your legitimate interest pursuant to Article 6(1)(f) of the GDPR, in order to make our website functional and user-friendly. As the website operator, we have a legitimate interest in storing necessary cookies to ensure the technically flawless and optimised provision of our services. Where we seek your consent for the use of cookies, processing is carried out on the basis of Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. Your consent may be withdrawn at any time.

Cookie consent with Usercentrics

Nature and scope of processing

We use Usercentrics’ consent technology to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies, and to document this in accordance with data protection regulations. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich (hereinafter “Usercentrics”).

When you visit our website, the following personal data is transmitted to Usercentrics:

  • Your consent(s) or the withdrawal of your consent(s)
  • Your IP address
  • Information about your browser
  • Information about your device
  • The time of your visit to the website

In order to be able to assign and document your consent or withdrawal of consent, the provider sets a cookie in your browser. This data is stored until you delete the cookie, request us to delete the data, or the purpose for data processing no longer applies. Statutory retention obligations remain unaffected.

Usercentrics is used to obtain the legally required consents for the use of certain technologies. The legal basis for this is Article 6(1)(c) of the GDPR.
 

Data processing

To ensure that personal data is processed in accordance with our specifications and in compliance with the GDPR, we have entered into a data processing agreement (DPA) with the provider.

Data processing in detail

Below, we provide information on the individual processing operations, the scope and purpose of data processing, the legal basis, the obligation to provide your data and the respective retention period. No automated decision-making, including profiling, takes place in individual cases.

Provision of the website

When you access and use our website, we collect the personal data that your browser automatically transmits to our server. The following information is temporarily stored in a so-called log file: 

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the file accessed
  • Website from which the access originated (referrer URL)
  • Browser used and, where applicable, your computer’s operating system, as well as the name of your internet service provider 

Our website is not hosted by us, but by a service provider who processes the aforementioned data on our behalf for the purpose of providing the website, in accordance with Article 28 of the GDPR. The use of the hosting provider is for the purpose of fulfilling our contractual obligations towards our potential and existing customers (Article 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (Article 6(1)(f) GDPR).

We use the following hosting provider:

1&1 IONOS SE
Greifswalder Str. 207
10405 Berlin

Contact form

Nature and scope of processing

When you send us enquiries (e.g. via the contact form, email or telephone), we store all data resulting from this (e.g. name, email address, subject of the enquiry, etc.). We require this data to process your enquiry and to be able to answer any follow-up questions. We will not pass on this data without your consent.

Purpose and legal basis

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. Otherwise, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR) if you have previously given it.

Retention period

The data you enter in the contact form will be retained by us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been processed). Mandatory legal provisions – in particular retention periods – remain unaffected.

Contact form for applicants

Nature and scope of processing

We collect and process the personal data of applicants. Such data processing may also take place electronically, for example, when applicants submit application documents to us via email or via a web form on our website. On our website, we offer you the option of submitting applications for advertised job vacancies to us via email.

Purpose and legal basis

We process the personal data of applicants in accordance with legal requirements for the purpose of establishing an employment relationship (Art. 6(1)(b) GDPR). You are not obliged to provide us with this data. However, without this data, we cannot carry out an application process with you.

If your application is successful, the data you have submitted will be stored in our data processing systems on the basis of Article 6(1)(b) of the GDPR and, insofar as you provide us with special categories of personal data such as health information, on the basis of Article 9(2)(b) for the purpose of carrying out the employment relationship.

We also use the professional networking services LinkedIn and XING to approach potential applicants. In this respect, the operators of these networks act as data processors on our behalf in accordance with our instructions. The legal basis for data processing when contacting potential applicants on our behalf is Article 6(1)(f) of the GDPR (our legitimate interests). If, following such contact, you send us your application, we process your data for the purpose of establishing an employment relationship as described above on the basis of Article 6(1)(b) of the GDPR.
 

Retention period

In the event of a rejection, your data will be stored for a period of 6 months beyond the conclusion of the application process. This is done to safeguard our legitimate interests, to assess whether we require the data to defend against any claims arising in connection with the application process. We are then obliged to delete or anonymise your data. In this case, the data will only be available to us as so-called metadata without any direct personal reference for statistical analysis (for example, the proportion of female and male applicants, the number of applications per period, etc.).

If it becomes apparent that further storage of the data is necessary after the expiry of the 6-month period to safeguard our legitimate interests (e.g. due to an impending or pending legal dispute), deletion will only take place once the purpose for the continued storage no longer applies. The legal basis for this further data storage is our legitimate interest in the assertion, exercise or defence of civil law claims (Art. 6(1)(f) GDPR in conjunction with Section 24(1)(2) BDSG or, where special categories of personal data are stored, Art. 9(2)(f) GDPR in conjunction with Section 24(2) BDSG).
 

Inclusion in the applicant pool

As part of the application process, we offer applicants the opportunity to be included in our “talent pool” for a period of 24 months on the basis of consent within the meaning of Article 6(1)(a) and Article 9(2)(a) of the GDPR. If you have provided special categories of personal data in your application, such as health information, your consent also extends to this data. You are not obliged to provide us with your application data for our talent pool. However, without this data, we cannot consider you for future vacancies unless you submit a new application.

Consent to the inclusion of application data in the Talent Pool is voluntary and may be withdrawn at any time with future effect. Withdrawal of consent does not affect the lawfulness of data processing carried out on the basis of consent prior to withdrawal.

Your application documents will be deleted from the talent pool at the latest upon expiry of the retention period, or in the event of a withdrawal of consent, or upon acceptance of a job offer from one of the companies responsible for the talent pool.
If, as part of the application process, you receive an offer of employment from us and accept it, we or that company will store the personal data collected during the application process for the purpose of implementing the employment relationship. The legal basis for this data processing is Article 6(1)(b) of the GDPR or, insofar as you provide us with special categories of personal data such as health information, Article 9(2)(b).
 

Newsletter

We offer our newsletter on this website. If you wish to subscribe to it, we require your email address and further data to verify that the email address belongs to you and that you consent to receiving the newsletter. No other personal data is collected unless you provide it voluntarily (e.g. name, telephone number, place of residence, etc.).

When processing the data you provide when registering for the newsletter, we rely exclusively on your consent pursuant to Article 6(1)(a) of the GDPR as the legal basis. You may withdraw your consent to the processing and storage of your personal data at any time (e.g. via the ‘Unsubscribe’ link in the newsletter) with effect for the future.

We store the personal data you have provided for the purpose of receiving the newsletter until you unsubscribe from the newsletter via us or the mailing service provider. This does not apply to data we have stored about you for other purposes.
If you unsubscribe from the newsletter mailing list, your email address will be stored by us or the mailing service provider on a blacklist for an indefinite period. This is done to prevent future mailings from being sent to you. The data from the blacklist is used exclusively for this purpose and is not combined with other data. This is not only in your interest, but also in our legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR) to fulfil our legal obligations regarding the sending of newsletters. You may object to the storage of your data if your personal interests override our legitimate interest.
 

CleverReach

This website uses CleverReach to send newsletters. The provider is CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.

CleverReach is a service that organises and analyses the sending of newsletters. Data that you enter to receive newsletters (e.g. your email address) is stored on CleverReach’s servers in Germany or Ireland.
 

Data analysis by CleverReach

CleverReach allows us to monitor the performance of our newsletter. We can determine whether a newsletter has been opened, which links have been clicked, and what further actions were taken after opening or clicking the newsletter, e.g. a purchase. This enables us to analyse and evaluate our newsletter campaigns with the help of CleverReach.

CleverReach also allows us to tailor the newsletters more effectively to our target groups by segmenting newsletter recipients into different categories, such as age, gender or place of residence. If you object to analysis by CleverReach, you can unsubscribe from the newsletter via a link. This link is available in every newsletter you receive.

Further information on data analysis by CleverReach newsletters can be found here: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.
 

Legal basis

The processing of your data is based on your consent (Article 6(1)(a) of the GDPR). You may withdraw this consent at any time. This does not affect the lawfulness of any data processing operations that have already taken place.

You can find CleverReach’s privacy policy here: https://www.cleverreach.com/de/datenschutz/.

Retention period

Data that you provide to us for the purpose of sending the newsletter is stored by us or the newsletter service provider. This applies until you unsubscribe from the newsletter. Data stored by us for other purposes remains unaffected by this.

If you unsubscribe from our newsletter, we may store your email address in a blacklist. This ensures that we do not send newsletters to people who have unsubscribed. The data from the blacklist is used solely for this purpose and is not combined with other data. This serves your and our interests (Art. 6(1)(f) GDPR) with regard to compliance with legal requirements for sending newsletters. The storage of your data in the blacklist is not time-limited. You have the right to object to the storage of your data by contacting , provided that your interests outweigh our legitimate interests.

Data processing

To ensure that personal data is processed in accordance with our specifications and in compliance with the GDPR, we have entered into a data processing agreement (DPA) with the provider.

Partner accounts

We offer Volksheimstätte partners the opportunity to register on our data portal. The mandatory details requested during registration must be provided in full. These include: surname, first name, username, work email address. You have the option to provide further details on a voluntary basis.

For important changes, such as to the scope of services or technically necessary changes, we will use the email address provided during registration to inform you.

The processing of the data entered during registration, as well as the data uploaded to the portal, is carried out for the purpose of fulfilling the contractual relationship established by the registration and, where applicable, to initiate further contracts (Art. 6(1)(b) GDPR).

We store the data collected during registration for as long as you remain registered on this website, after which it is deleted. Statutory retention periods remain unaffected. Data uploaded by you to the portal is generally deleted after 90 days. We offer our partners the option of extending the storage period by mutual agreement. Storage is then carried out on the basis of your consent within the meaning of Article 6(1)(a) of the GDPR.
 

Video Conferences

Data processing

We use online conferencing tools to communicate with our customers. The specific tools we use are listed below. When you communicate with us via video or audio conference, your personal data is collected and processed by us and the provider of the relevant tool.

The tools collect the data you provide, including your email address and telephone number. They also process the duration of the conference, when you joined the conference, the number of participants and other metadata.

In addition, the tool provider processes all technical data necessary for the conference to take place. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and the type of connection.

When you share content via this service, it is stored on the providers’ servers. This includes cloud recordings, chat messages, voice messages, as well as photos and videos that you have shared whilst using this service.

Please note that we do not have full control over the data processing operations of the tools used. For further details on data processing by the conference tools, please refer to the privacy policies of the respective tools used.
 

Purpose and legal basis

The conference tools are used to communicate with prospective or existing contractual partners or to offer specific services to our customers (Art. 6(1)(b) GDPR). Furthermore, the use of the tools serves to generally simplify and expedite communication with us or our company (legitimate interest within the meaning of Art. 6(1)(f) GDPR). If you have previously given your consent to data processing, the processing of your data takes place solely on the basis of Article 6(1)(a) of the GDPR; consent may be withdrawn at any time.

Retention period

The data collected directly by us via the video and conferencing tools will be deleted from our systems as soon as you request us to do so, withdraw your consent to storage, or the purpose for data storage no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence over the storage period of your data that is stored by the operators of the conference tools for their own purposes. For further details, please contact the operators of the conference tools directly.

Conference tools used

We use the following tools for video conferencing:

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. For details on data processing, please refer to the Microsoft Teams privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

The company is certified under the "EU-US Data Privacy Framework" (DPF), an agreement between the European Union and the USA which aims to ensure compliance with European data protection standards when processing data in the USA. Certification under the DPF obliges companies to comply with these data protection standards. Further information is available at: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000KzNaAAK&status=Active 
 

ImmoSolve

Nature and scope of data processing

We use the ImmoSolve CRM system to process user enquiries in our prospective buyer form. The provider is ImmoSolve GmbH, Tegelbarg 43, 24576 Bad Bramstedt.

Purpose and legal basis

We use this module to manage our residential properties and to record prospective tenants for our advertised flats. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. When you enter your data in our property listings, it is stored in a database at ImmoSolve GmbH, to which only members of our housing department have access. We have entered into a data processing agreement with ImmoSolve.

If users do not consent to data collection and storage in ImmoSolve’s external system, we offer alternative contact options for submitting service enquiries via email, telephone or post.

Further information can be found in ImmoSolve’s privacy policy: https://www.immosolve.de/Datenschutz. 

etracker

On this website, we use services and functions provided by etracker, offered by etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany, to analyse the behaviour of our website visitors.

Through this analysis, visitor data is collected which can be used to create pseudonymised user profiles. In doing so, etracker uses technologies (e.g. cookies or fingerprinting systems) to recognise visitors when they return to the website. The data collected is not used to identify you as a user or to combine it with other personal information about you, unless you give your consent to do so.

When using etracker, we rely on Article 6(1)(f) of the GDPR as the legal basis for the processing of personal data, as we have a legitimate interest in analysing the use of our website. This enables us to optimise our online presence and offerings for you. If you have previously given your consent to data processing on this website via etracker, the processing of your data takes place solely on the legal basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time.

Data processing

To ensure that personal data is processed in accordance with our specifications and in compliance with the GDPR, we have entered into a data processing agreement (DPA) with the provider.

Nature and scope of processing

If you take part in our competitions (e.g. on our website), we process all data resulting from this (e.g. name, email address, membership number, etc.). We require this data to verify whether you are eligible to take part in the competition and to run the competition.

Purpose and legal basis

We process your data exclusively for the purposes of the competitions. Your data will not be passed on to third parties, with the exception of the winners, whose contact details must be passed on to the relevant service provider by mutual agreement for the delivery of the prizes. The legal basis for data processing is our legitimate interest in processing the data you have submitted to participate in the competition (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR) if you have previously given it.

Retention period

Once the competition has ended, participants’ data will be deleted within 14 days at the latest.