This data protection statement applies to all websites, services and offers provided by KGAL GmbH & Co. KG and its subsidiaries (hereinafter referred to as “KGAL”), unless otherwise indicated from the general context. In the sense defined above, this statement also applies for companies managed by KGAL. The specific data processed and how they are used are determined by the services which you request and/or which have been agreed with you.

What does data protection involve? At its core, it is about protecting natural persons during the processing of personal data. What is personal data? Personal data refers to any information pertaining to an identified or identifiable natural person (hereinafter referred to as “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name or an identification number (including online identifiers).

Should you have any questions that are not answered by this data protection statement or if you would like further information on any point, please do not hesitate to contact our data protection officer at any time. In this context, we will, of course, respect your right to information. The contact details for our data protection officer are as follows:

Datenschutzbeauftragter der KGAL-Gruppe (KGAL Group Data Protection Officer)

Tölzer Straße 15

D-82031 Grünwald

P +49 89 64143 0

datenschutz(at)kgal.de

Our data protection statement does not apply to services offered by other companies or individuals or other websites connected with our services. Our data protection statement does not cover the processing of information by other companies or organisations that advertise our services and which may use cookies, pixel tags and other technologies to provide and offer relevant advertising.

When you access an external website via our website (external link), the external provider may receive information from your browser indicating which of our websites you used to access the external site. The external provider is responsible for this data. Like any other website provider, we are not in a position to influence this process.

KGAL would like to thank you for your visit to our website and your interest in our company and/or products and services. We would like you to know what personal data we collect and when – and how we use it.

1. General:

You do not need to provide any confirmation prior to using our website with the exception of the question concerning your nationality in the institutional login area. Therefore, when you visit our website, we process personal data pertaining to you that you provide to us automatically through technical means and/or when you contact us. In addition, data are transferred to our partners for analysis and marketing.

2. Who is responsible for processing your data (controller) and who is the Data Protection Officer?

KGAL GmbH & Co. KG
Tölzer Straße 15
D-82031 Grünwald

P +49 89 64143 0
F +49 89 64143 150
kgal(at)kgal.de

and its subsidiaries.

You can reach our company data protection officer using the following contact details:

Datenschutzbeauftragter der KGAL-Gruppe (KGAL Group Data Protection Officer)
Tölzer Straße 15
D-82031 Grünwald

P +49 89 64143 0
datenschutz(at)kgal.de

3. What data pertaining to you do we process and why?

Server log files

When you visit our websites or use our service, the device you are using and the browser with which you access our website automatically transmit log data to our server. This log data includes, in particular, the name of the file (webpage) accessed, the volume of data transmitted, the type and version of the browser used, the operating system used (type and version), the date and time you accessed the site, the referrer URL (website from which you accessed our website via a link) and the IP address of the requesting computer. The IP address is stored in truncated form (anonymised) once it is no longer technically required for accessing the web content.

The automatically transmitted data listed above is collected and evaluated exclusively for the purposes of displaying the information offered correctly, as well as for statistical evaluation purposes. The legal basis for the processing of personal data is point (f) of the first sentence of Article 6(1) GDPR. We are unable to associate the data transmitted automatically to the server to any natural person, i.e. in principle, it is not possible to identify you directly using the automatically transmitted data. However, please be aware that with the cooperation of your internet service provider, it is theoretically possible to determine the owner of the internet connection via which you access our website using the IP address transmitted for a specific period. Your internet service provider can provide you with information on the duration for which it stores used and assigned IP addresses.

We process personal data such as name, address, telephone number or email address on this website solely for the purposes of preserving our own legitimate business interests with respect to the care of our investors, interested parties and/or other business partners. Otherwise, we use the data you voluntarily provide exclusively for the purpose for which you provided it to us. We will only use your data in connection with further offers or for marketing purposes if you have consented to such use.

Press mailing list | newsletter

If you subscribe to our email newsletter, we will send you information about our offerings on a regular basis. The only mandatory information you must provide in order to receive our newsletter is your email address. Any other details are provided voluntarily and will be used to enable us to address you personally. We use the double opt-in process when you register for our newsletter. This means that we will only send you an email newsletter once you have expressly confirmed that you consent to our sending you the newsletter. We will then send you a confirmation email, in which you will be asked to confirm, by clicking the corresponding link, that you wish to receive the newsletter in future.

When you click the confirmation link, you provide us with your consent for the use of your personal data pursuant to point (a) of Article 6(1) GDPR. When you register for our newsletter, we store the IP address transmitted by your internet service provider as well as the date and time of registration in order to allow us to provide proof of any possible misuse of your email address at a later point. The data we collect when you register for our newsletter is used exclusively for the purposes of advertising communications in the form of the newsletter.

You can unsubscribe from the newsletter at any time by clicking the link provided in the newsletter or by sending a message to the controller specified above. After you have successfully unsubscribed, your email address will be immediately deleted from our newsletter mailing list unless you have expressly consented to the further use of your data or unless we reserve the legally permissible right to process your data for other purposes, about which we inform you in this declaration.

If you use our contact form in the press mailing list to contact us, the data you enter into it will be transmitted in encrypted (SSL) format in order to protect it against improper use by third parties. You can see that the connection is encrypted from the address line of the browser, which will change from “http://” to “https://” and also from the closed padlock symbol in your browser line. Once the SSL encryption is active, the data you transmit to us cannot be viewed by third parties.

Email handling

If you sent an email to KGAL from our website, the message content is cryptographically encrypted. This means that only the recipient can read the message. We will use the email address you provide to respond to you via email with the information you have requested.

If the content of your message pertains to a contractual relationship, we will store the email. The legal basis for the processing of personal data is point (b) of the first sentence of Article 6(1) GDPR. Before sending us an unencrypted email via your internet provider, please be aware that the content of the email may not necessarily be protected against unauthorised access, falsification, etc. Please understand that if you send us an email, external service providers that filter emails for us to eliminate spam and malware may have access to your email.

Downloads

Access data is saved whenever you request a file in our download area. Each data set consists of the following: the page from which the file was requested, the name of the file, date and time of the request, the volume of data transmitted, the access status (file transmitted, file not found, etc.) and a description of the type of browser used and the IP address.

4. Who will receive your data?

Your requests will be transmitted to the respective responsible department of KGAL. We use selected service providers for the technical and organisational implementation of our website. The extent of the data transmitted to these service providers is limited to the minimum possible. These processors are contractually obliged to process the data received exclusively in accordance with our instructions. Compliance with the General Data Protection Regulation is ensured. This applies with regard to data storage, for example. Our certified processors store the data in secure data centres that are located within the European Union.

5. Cookies | general

We use cookies on our website to help us present our website attractively to visitors and enable them to use specific functions. Cookies are small text files that are saved on your end device. These are small text files that are stored on your device (e.g. laptop, tablet, or smartphone) when you visit our site. Information is stored in the cookie that results, in each case, from the specifically used device.

Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser window (session cookies). Other cookies remain on your end device and allow us or our partner companies (third-party cookies) to recognise your browser upon your next visit (persistent cookies). As a result, you will not need to re-enter input or re-apply settings.

If cookies are used, they individually collect and process user information such as browser and location data as well as IP address values. Persistent cookies are automatically deleted after a defined period, which may differ depending on the cookie.

Some cookies are used to simplify the order process by saving settings (e.g. remembering the content of a virtual shopping basket for a subsequent visit to the website). Where individual cookies implemented by us process personal data, they do so in accordance with either point (b) of Article 6(1) GDPR, for the performance of the contract, or in accordance with point (f) of Article 6(1) GDPR, in our legitimate interests with regard to ensuring the optimum functionality of the website and ensuring a customer-friendly, effective configuration when you visit our website.

To this end, partner company cookies are stored on your hard drive when you visit our website (third-party supplier cookies). The following section 6 provides individual, separate information about the use of these cookies and the extent of the information they collect in cases where we collaborate with the aforementioned advertising partners.

Please note that you can configure your browser to inform you when cookies are being placed on your computer and allow you to decide whether to accept them on a case-by-case basis; alternatively, you can accept cookies in certain cases or disable cookies in general. Each browser manages cookie settings in a different way. This is described in the Help menu of each browser, which explains how to change your cookie settings. You can find the Help menu for your respective browser using the following links:

Internet Explorer: support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

Firefox: support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

Chrome: support.google.com/chrome/answer/95647

Safari: support.apple.com/kb/ph21411

Opera: http://help.opera.com/Windows/10.20/en/cookies.html

Please note that the functionality of our website may be limited if you do not accept cookies. Clause 6 contains explanations concerning the statistics and tracking services used on this website, among other things.

6. What services do we use?

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies, which are text files stored on your computer, to help analyse how you use the website. The information generated by the cookie about your use of the website (including your truncated IP address) will be transmitted to a Google server in the United States and stored there.

This website uses Google Analytics with the “_anonymizeIP()” extension, which ensures that IP addresses are anonymised by truncating them, thereby eliminating the possibility that they can be associated directly with any person. The extension ensures that for users located within the European Union or in other parties to the Agreement on the European Economic Area, Google will truncate your IP address before transmitting it. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. In these exceptional cases, this processing is performed for the preservation of our legitimate interests in terms of the statistical analysis of user behaviour for optimisation and marketing purposes, in accordance with point (f) of Article 6(1) GDPR.

Google will use this information on our behalf to evaluate your use of the website, compile reports on website activities and provide us with additional services connected with your use of the website and internet usage. The IP address transmitted by your browser in connection with Google Analytics will not be merged with other data by Google.

You can prevent the storage of cookies by adjusting a corresponding setting in your browser software; however, please note that you may not be able to use all functions of this website to their full extent in this case. You can also prevent Google from collecting and processing the data created by the cookie and data related to your use of the website (including your IP address) by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en

As an alternative to using the browser plugin or for browsers on mobile devices, please click the following link to install an opt-out cookie, which will prevent the collection of data by Google Analytics via this website in the future (this opt-out cookie will only work in this browser and only for this domain; if you delete your cookies in this browser, you will need to click the link again): Deactivate Google Analytics

Google LLC, headquartered in USA, is certified under the “Privacy Shield” EU-U.S. Data protection agreement, which guarantees compliance with the level of data protection applicable in the EU. You can find more information about how Google processes user data in the Google Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=en

Social Media | Redirect buttons

Our websites contain redirect buttons that you can click to share content from our website on social media such as Facebook, Twitter, LinkedIn and Xing. We do not use these buttons to share your personal information with social media providers. They are simple links. When you click a redirect button, the social media provider collects personal information from you directly. However, we cannot exclude the possibility that the operators of the social networks will understand that you have been redirected from our site, have looked at our corporate presence on the network and where applicable have interacted with it, and that the operators use this information for their own advertising purposes. Please read the privacy policy of the social media provider with whom you wish to share content before clicking the corresponding redirect button. 

7. What data protection rights can you assert?

You can withdraw consent you have provided to the storage of your data and email address, as well as their use for sending the newsletter for example, using the “Unsubscribe” link in the newsletter. You can request access to the personal data stored concerning you by contacting the address specified above. In addition, you can request the rectification or erasure of your data. Furthermore, you may be due to a right to the restriction of processing of your data as well as a right to the provision of the data you have provided in a structured, commonly used, and machine-readable format. In addition, you have the right to lodge complaints with a supervisory authority for data protection.

The supervisory authority for data protection relevant for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach

poststelle(at)lda.bayern.de

Alternatively, you can also of course contact the data protection officer at KGAL Group at any time.

8. What right of objection are you entitled to?

Further information on your rights is provided in Section F. of this data protection statement.

9. How long is your data stored for?

The duration of storage of personal data is determined using the respective statutory retention period (e.g. retention periods under commercial and tax law). After the expiry of this timeframe, the corresponding data is routinely erased if it is no longer necessary for contract fulfilment or entering into contracts, and/or we no longer have a legitimate interest in continued storage.

10. Is your data transferred to a third country?

The analysis and marketing partners may transfer your personal data to third countries.

11. Competitions

Competitions are occasionally offered on the website. We process your personal data that you have provided during participation in a competition for the execution of the competition. The respective terms of participation and data protection statement for the competition apply.

12. Profiling measures?

The stored data is used exclusively for statistical purposes.

13. Data security

The data of which we are informed concerning your person is processed pursuant to the statutory provisions. KGAL employees shall treat as confidential your personal information that you communicate to us when visiting our homepage. All KGAL employees commit, in writing, to data secrecy. The data protection officer and internal audit department regularly review whether data protection provisions are complied with.

We have put in place the necessary technical and organisational measures in order to guarantee a high level of protection for your personal data: The KGAL data processing network is protected from the outside world by means of a firewall system in accordance with the current level of technological advancement. Applications internal to KGAL are only accessible to authorised individuals via a sign-in procedure with an individual user key and password. Within the applications, user rights are restricted in accordance with business need, using legitimation systems.

We are delighted that you are interested in our company and are applying or have applied for a position here. In the following, we would like to provide you with information about the processing of your personal data in the context of your application.

1. Who is responsible for processing your data (controller) and who is the Data Protection Officer?

The controller for data processing is the company advertising the position. Depending on the post for which you are applying or have applied, this is:

KGAL GmbH & Co. KG
Tölzer Straße 15
D-82031 Grünwald

P +49 89 64143 0
F +49 89 64143 150
kgal(at)kgal.de

or one of its subsidiaries.

You’ll find further information about our company and individuals with authorisation to represent, as well as additional contact options, on our website’s legal notice.

You can reach our company data protection officer using the following contact details:

Datenschutzbeauftragter der KGAL-Gruppe (KGAL Group Data Protection Officer)
Tölzer Straße 15
D-82031 Grünwald

P +49 89 64143 0
datenschutz(at)kgal.de

2. Which of your data we process

In particular, the categories of personal data that are processed include your core data (such as your first name, surname, name affixes, and nationality), contact details (such as your personal address, phone number, and email address), and the data from the entire application procedure (title, certificates, questionnaires, interviews, qualifications, and previous activities). If you have also voluntarily communicated special categories of personal data (such as health data, religious affiliation, or level of disability) in the course of the application procedure, this data will only be processed if you have provided corresponding consent or where legal circumstances justify authorisation for processing.

3. For which purposes is your data processed?

Data processing serves the execution and handling of the obligation procedure and the assessment as to and how far the relevant candidate is suitable for the aptitude for the intended activity. It is necessary to process your data in order to make a decision regarding the establishment of a contractual relationship.

4. Which legal basis is taken into consideration?

The legal basis for processing of personal data in this application procedure is point (b) of Article 6(1) GDPR in conjunction with Section 26(1) of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).  In accordance with this, it is permissible to process data that is necessary in the context of making a decision regarding the establishment of an employment relationship. Processing may also be based on additional laws (such as the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG) and the  General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz, AGG)), as well as other legal regulations such as money-laundering, tax, and social insurance law, etc. In as far as the legal basis for data processing is a declaration of consent, you have the right to withdraw consent at any time with immediate effect.

In individual cases, we process your data in order to safeguard justified interests held by us or third parties (such as public authorities). This applies in particular with respect to the clarification of criminal acts (legal basis: point (f) of Article 6(1) GDPR – in conjunction with the second sentence of Section 26(1) BDSG in the event of employment relationships) or the exchange of data within the Group for administrative purposes. The processing of special categories of personal data (e.g. health data) is based on your consent in accordance with point (a) of Article 9(2) GDPR in conjunction with Section 26(2) BDSG in the event of employment relationships, unless legal circumstances justifying authorisation for processing are relevant such as point (b) of Article 9(2) – in conjunction with Section 26(3) BDSG in the event of employment relationships.

5. Where does your data come from?

Your data is generally gathered directly from you as part of the application process. In addition, we may have received data from third parties (e.g. employment agencies) to whom you have provided your data for transfer.

6. Who will receive your data?

Within our company, only the individuals and offices (e.g. the department and Works Council) who require your data for making a decision about contract conclusion and fulfilling our pre-contractual, contractual and legal duties, receive your personal data. The application process takes place mainly via KGAL GmbH & Co. KG itself, and as a result your data is also processed there.

7. What data protection rights can you assert?

You can request access to the personal data stored concerning you by contacting the address specified above. In addition, you can request the rectification or erasure of your data under certain circumstances. Furthermore, you may be due to a right to the restriction of processing of your data as well as a right to the provision of the data you have provided in a structured, commonly used, and machine-readable format. In addition, you have the right to lodge complaints with a supervisory authority for data protection.

The supervisory authority for data protection relevant for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
D-91522 Ansbach

poststelle(at)lda.bayern.de

Alternatively, you can also contact the above-named business data protection officer that is relevant to you at any time. Further information on your rights is provided in Section F. of this data protection statement.

8. What right of objection are you entitled to?

If we process your data to safeguard legitimate interests, you can object to this processing on grounds that arise based on your particular situation. We will then no longer process your personal data unless we are able to prove mandatory, legitimate grounds for processing which override your interests, rights and freedoms, or unless processing serves the establishment, exercise or defence of legal claims.

9. How long is your data stored for?

We erase your personal data six months after the application procedure is complete, provided that a contractual relationship is not in place. This does not apply if legal provisions contradict erasure or further storage is necessary for the purposes of providing proof, or you have consented to a longer storage period.

10. Is your data transferred to a third country?

Your personal data is not transferred to a third country. Third countries are states outside the European Economic Area.

11. In how far do automated individual decision-making or profiling measures take place?

We do not use any automated processing procedures in order to make decisions. This includes profiling.

1. Who is responsible for processing your data (controller) and who is the Data Protection Officer?

General information: Your lessor is the controller for data processing. This entity is party to the rental agreement concluded with you, to which we make reference at this point. Please use the lessor’s company, using the postal address which has been notified to you. Would you like to contact one of our management companies which has been notified to you? This is:

KGAL GmbH & Co. KG
Tölzer Straße 15
D-82031 Grünwald
P +49 89 64143 0
F +49 89 64143 150
kgal(at)kgal.de

or one of its subsidiaries.

You can reach our company data protection officer using the following contact details:

Datenschutzbeauftragter der KGAL-Gruppe (KGAL Group Data Protection Officer)
Tölzer Straße 15
D-82031 Grünwald

P +49 89 64143 0
datenschutz(at)kgal.de

2. Which of your data do we process?

Relevant personal data are personal particulars (your name, address and other contact details, date of birth, birth name, place of birth, job, marital status, nationality) and legitimation data (e.g. ID data) and authentication data (e.g. signature sample) and other core and contract data e.g. information regarding existing contracts, payment details, and roles of the data subject (e.g. lessee). In addition, this may also be order-related data (e.g. a payment order), data from the fulfilment of our contractual obligations (e.g. revenue data in payment transactions) information about your financial situation (e.g. salary and credit data), data on lessee contacts and procedure processing as well as other data which are comparable with the named categories.

3. For which purposes is your data processed?

Your personal data is processed in order to provide leasing activities which take place on request, and to execute your orders as well as all activities necessary in the operation and management of real estate. The purposes of data processing include bills of utility costs, maintenance/repairs, and the execution of transactions, among others. Further details regarding the purpose of data processing are available in the respective contract documents.

4. What is the legal basis for processing?

The data are processed in fulfilment of the rental agreement and therefore in accordance with point (b) of Article 6(1) GDPR. In as far as necessary, we process your data beyond the actual fulfilment of the contract in order to safeguard legitimate interests in accordance with point (f) of Article 6(1) GDPR. In the consultation of and data exchange with credit agencies, this may serve to determine credit and default risks, establish legal claims and provide defence in the event of legal disputes, guarantee IT security and IT operation, prevent and clarify criminal acts, provide video monitoring for the collection of evidence in the event of criminal acts and therefore to protect lessees and employees, as well as to safeguard domiciliary rights and building and plant security.

In as far as you have issued us consent to process personal data for certain purposes, this processing is legally valid based on your consent pursuant to point (a) of Article 6(1) GDPR. Once consent has been issued, it may be withdrawn at any time. Please note that the withdrawal only applies with effect for the future.

In addition, we are subject to various legal obligations, i.e. statutory requirements in accordance with point (c) of Article 6(1) GDPR (e.g. money-laundering law, and tax laws) as well as supervisory specifications. The purposes of processing include credit checks, identity and age checks, the prevention of fraud and money laundering, the fulfilment of control and reporting obligations under tax law, the assessment and management of risks, and disclosure to authorities, among others.

5. Where does your data come from?

We process personal data that we have received from you in the context of our business relationship, e.g. through the rental agreement. In addition – in as far as necessary for the provision of our service – we process personal data that we have permissibly (e.g. due to consent that you have given us) obtained from partners responsible for you or from other third parties (e.g. SCHUFA) or will receive in future (e.g. to execute orders or fulfil contracts, or due to consent you have given us). In addition, we process personal data that we have permissibly obtained from publicly accessible sources (e.g. land registers, commercial registers, registers associations, the press, the internet, and media), and are permitted to process.

6. Who will receive your data?

Within KGAL, those offices that require your data for the fulfilment of contractual and legal obligations receive access to your data. Service providers, agents, and processors (Article 28 GDPR) used by us may receive data for these specified purposes, if they maintain data protection. These include companies in the categories of real estate management, IT services, telecommunications, collection, advice and consultancy, and address research, among others.

We only transfer information concerning you if legal provisions permit or mandate such transfer, you have provided your consent, or we are entitled to issue information.  Subject to these requirements, the recipients of personal data may be for example: Public offices and institutions (e.g. financial authorities and law enforcement agencies) in the event of a legal or official obligation, banks and financial services institutions or comparable institutions to which we transfer your personal data in order to execute the business relationship with you (e.g. guarantors and credit agencies) as well as other companies within KGAL Group in as far as this is necessary for the fulfilment of services.

7. What data protection rights can you assert?

Each data subject has the right to access in accordance with Article 15 GDPR, the right to rectification in accordance with Article 16 GDPR, the right to erasure in accordance with Article 17 GDPR, the right to restriction of processing in accordance with Article 18 GDPR, and the right to data portability arising from Article 20 GDPR. The restrictions in accordance with Sections 34 and 35 BDSG apply with respect to the right to access and the right to erasure. In addition, there is a right to submit a complaint to a relevant supervisory authority for data protection (Article 77 GDPR in conjunction with Section 19 BDSG). You can at any time withdraw any consent you have issued to us for the processing of personal data. This also applies for the withdrawal of consent declarations that were issued to us before the General Data Protection Regulation came into effect, i.e. before 25 May 2018. Please note that the withdrawal only applies with effect for the future. You have the option of contacting the data protection officer at KGAL Group specified above, or a supervisory authority for data protection, with a complaint.

The supervisory authority for data protection relevant for companies who have their registered office in Bavaria is as follows:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18

91522 Ansbach

poststelle(at)lda.bayern.de

8. What right of objection are you entitled to?

If we process your data to safeguard legitimate interests, you can object to this processing on grounds that arise based on your particular situation. We will then no longer process your personal data unless we are able to prove mandatory, legitimate grounds for processing which override your interests, rights and freedoms, or unless processing serves the establishment, exercise or defence of legal claims.

9. How long is your data stored for?

We process and store your personal data for as long as is necessary for the fulfilment of our contractual and legal obligations. In this respect, it must be noted that our business relationship is a continuing obligation developed over the course of years. In addition, we are subject to various retention and documentation obligations arising from the German Commercial Code (Handelsgesetzbuch, HGB) and the German Tax Code (Abgabenordnung, AO), among others. The timeframes stated therein for retention and/or documentation are up to ten years beyond the end of the business relationship and/or the pre-contractual legal relationship. Ultimately, the duration of storage is also assessed in accordance with the legal limitation periods, which are, for example, generally three years in accordance with Sections 195 et seqq. of the German Civil Code (Bürgerliches Gesetzbuch, BGB), but in certain cases even up to thirty years.

We erase your personal data as soon as it is no longer required for the purposes stated above. In this process, it may be that personal data is stored for the period during which claims may be established against our company. In addition, we store your personal data in as far as we are legally required to do so. Corresponding obligations regarding documentation and retention arise from the HGB, AO and the Money Laundering Act (Geldwäschegesetz, GwG). The storage periods in accordance with these laws is up to ten years.

10. Is your data transferred to a third country?

Personal data is only transferred to entities in states outside the European Union (EU) and/or the European Economic Area (EEA) (referred to as third countries) in as far as necessary for the handling of your orders (e.g. a payment order sent to a third country). Otherwise, no personal data is transferred to third countries.

In the context of remote maintenance of standard IT components, it cannot be ruled out that – in order to remedy an error – an IT service provider from a third country (such as the USA) will in rare cases be able to view personal data, on a controlled and limited basis. We will inform you separately of details in this respect, in as far as is legally required.

If it is necessary for us to transfer personal data to service providers in third countries, we will only do so in as far as the EU commission has confirmed an appropriate level of data protection, or alternative, appropriate guarantees of data protection (e.g. binding data protection specifications within companies or standard EU contractual clauses) are in place.

11. Are you required to provide data?

In the context of the lease relationship, you are only required to provide personal data that is necessary for the establishment, implementation, and termination of the business relationship, or that we are legally required to capture. Without this data, we will generally have to refuse to conclude the contract or execute the order, or will be unable to continue an existing contract and may need to end it.

12. To what extent is automated decision-making used in individual cases?

In order to enter into and implement the business relationship, as a rule we do not use any automated decision-making pursuant to Article 22 GDPR. If we use these procedures in individual cases, we will inform you of this separately, in as far as is legally required.

13. To what extent will your data be used for profiling?

We do not process your data for the purpose of assessing certain personal aspects on an automated basis.

1. Who is responsible for processing your data (controller) and who is the Data Protection Officer?

KGAL GmbH & Co. KG
Tölzer Straße 15
D-82031 Grünwald

P +49 89 64143 0
F +49 89 64143 150
kgal(at)kgal.de

or one of its subsidiaries.

You can reach our company data protection officer using the following contact details:

Datenschutzbeauftragter der KGAL-Gruppe (KGAL Group Data Protection Officer)
Tölzer Straße 15
D-82031 Grünwald

P +49 89 64143 0
datenschutz(at)kgal.de

2. Which of your data we process

The categories of personal data processed include in particular your core data (such as your first name, surname, name affixes, nationality, date and place of birth, business), contact details (such as your personal address, tax domicile, phone number and email address), and the data concerning your participation in one of our products (limited liability capital, capital calls, payouts, etc.) and for payment and other processing (bank details, tax number and country [domestic and foreign], relevant financial authority, etc.).

3. For which purposes is your data processed?

Data processing serves to execute the investment offering.

4. Which legal basis is taken into consideration?

The legal basis for the processing of personal data is point (b) of Article 6(1) GDPR. In accordance with this, the processing data required in fulfilment of the contract is permissible. Processing may also be based on additional laws as well as other legal regulations such as money-laundering and tax laws (domestic and foreign). In as far as the legal basis for data processing is a declaration of consent, you have the right to withdraw consent at any time with immediate effect.

In individual cases, we process your data in order to safeguard justified interests held by us or third parties (such as public authorities). This applies in particular with respect to the clarification of criminal acts (legal basis: point (f) of Article 6(1), GDPR) or the exchange of data within the Group for administrative purposes.

5. Where does your data come from?

Your data is generally gathered directly from you. In addition, we may have received data from third parties (e.g. agencies), to whom you have provided your data for transfer.

6. Who will receive your data?

Within our company, only the individuals and offices (e.g. the department) who require your data for making a decision about contract conclusion and fulfilling our pre-contractual, contractual and legal duties, receive your personal data. Other recipients of your data are those responsible for implementing and managing the investment, in particular administrators, tax consultants, auditors and domestic and foreign tax authorities.

7. What data protection rights can you assert?

You can request access to the personal data stored concerning you by contacting the address specified above. In addition, you can request the rectification or erasure of your data under certain circumstances. Furthermore, you may be due to a right to the restriction of processing of your data as well as a right to the provision of the data you have provided in a structured, commonly used, and machine-readable format. In addition, you have the right to lodge complaints with a supervisory authority for data protection.

The supervisory authority for data protection relevant for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach

poststelle(at)lda.bayern.de

Alternatively, you can also contact the above-named business data protection officer that is relevant to you at any time. Further information on your rights is provided in Section F. of this data protection statement.

8. What right of objection are you entitled to?

If we process your data to safeguard legitimate interests, you can object to this processing on grounds that arise based on your particular situation. We will then no longer process your personal data unless we are able to prove mandatory, legitimate grounds for processing which override your interests, rights and freedoms, or unless processing serves the establishment, exercise or defence of legal claims.

9. How long is your data stored for?

We process and store your personal data for as long as is necessary for the fulfilment of our contractual and legal obligations. In this respect, it must be noted that our business relationship is a continuing obligation developed over the course of years. In addition, we are subject to various retention and documentation obligations arising from the German Commercial Code (Handelsgesetzbuch, HGB) and the German Tax Code (Abgabenordnung, AO), among others. The timeframes stated therein for retention and/or documentation are up to ten years beyond the end of the business relationship and/or the pre-contractual legal relationship. Ultimately, the duration of storage is also assessed in accordance with the legal limitation periods, which are, for example, generally three years in accordance with Sections 195 et seqq. of the German Civil Code (Bürgerliches Gesetzbuch, BGB), but in certain cases even up to thirty years.

We erase your personal data as soon as it is no longer required for the purposes stated above. In this process, it may be that personal data is stored for the period during which claims may be established against our company. In addition, we store your personal data in as far as we are legally required to do so. Corresponding obligations regarding documentation and retention arise from the HGB, AO and the Money Laundering Act (Geldwäschegesetz, GwG). The storage periods in accordance with these laws is up to ten years.

10. Is your data transferred to a third country?

Your personal data is not transferred to a third country. Third countries are states outside the European Economic Area.

11. Are you required to provide data?

In the context of the investment relationship, you are only required to provide personal data that is necessary for the establishment, implementation, and termination of the investment, or that we are legally required to capture. Without this data, we will generally have to refuse to conclude the investment or execute the order, or will be unable to continue an existing contract and may need to end it.

12. In how far do automated individual decision-making or profiling measures take place?

We do not use any automated processing procedures in order to make decisions. This includes profiling.

1. General:

KGAL conducts surveys and uses various service providers in this process. KGAL may invite interested parties to the survey for this purpose. Participation in surveys is voluntary.

2. Who is responsible for processing your data (controller) and who is the Data Protection Officer?

KGAL GmbH & Co. KG
Tölzer Straße 15
D-82031 Grünwald
Germany
Phone +49 89 64143 0
Fax +49 89 64143 150
Email kgal(>@<)kgal.de

Contact details for our company data protection officer:

Datenschutzbeauftragter der KGAL-Gruppe (KGAL Group Data Protection Officer)
Tölzer Straße 15
D-82031 Grünwald
Germany

Phone +49 89 64143 0
Email: datenschutz(>@<)kgal.de

3. What personal data do we process and why?

The categories of personal data that we process include, in particular, your master data (such as your first name, surname, including prefixes and suffixes,) contact data (such as your address, phone number, email address), use and device data (such as your IP address, browser, and submission time). These are collected in the context of surveys. We will collect and process your data and answers exclusively for this purpose.

4. What services do we use?

Surveygizmo from Widgix

For the surveys, KGAL may use SurveyGizmo (https://www.surveygizmo.com/), Widgix LLC, 4888 Pearl East, Circle Suite 300W, Boulder, CO 80301, USA. Widgix is an application provider that, among other services, enables its customers to set up and run online surveys, and to evaluate the results. In this role, Widgix acts as a data processor for KGAL. Widgix uses your answers in the survey only to fulfil this service for KGAL, and does not disclose your answers to third parties. In the course of the surveys, KGAL collects the data specified in the above section 3 with the aid of SurveyGizmo. After filling out a survey, your data is stored by Widgix in the EU AWS data centre in Frankfurt, Germany. Widgix will not store your data for longer than is required to conduct the KGAL survey, fulfil legal obligations, settle disputes, and fulfil their agreements. Widgix only discloses your data to KGAL. Once you have filled out and submitted a survey, you are no longer able to access your survey and/or edit it.

SHAREPOINT

If Microsoft Office 365 products are used for surveys instead of SurveyGizmo, Microsoft is the application provider. Microsoft Ireland stores the transferred data in the Microsoft Global Foundation Services data centres located in Dublin and Amsterdam; Microsoft Global Foundation Services is a business unit in the Microsoft Corporation, USA (“Microsoft Corp.”), which Microsoft Ireland subcontracts in this respect. In addition, Microsoft Corp. uses subcontractors for various service activities in the operation of Office 365. As an adequate level of protection comparable with EU standards is not always guaranteed in locations outside Europe – including in the USA among others – Microsoft Corp. has signed up to the Privacy Shield. Based on a decision by the EU Commission, these regulations create an appropriate level of data protection at Microsoft Corp. In addition, Microsoft Ireland has concluded the ‘standard EU contractual clauses’ with Microsoft Corp, which also guarantee an appropriate level of data protection at Microsoft Corp. Microsoft Corp. concludes a contract with subcontractors, the content of which is equivalent to the standard EU contractual clauses.

Additional details on the subject of Office 365, f. e. SharePoint Online as well as data protection, security, and transparency in Office 365 are available on the Microsoft website Data Protection for DSGVO-Compliance – with Office 365.   ( https://www.microsoft.com/en-us/trustcenter/CloudServices/office365/GDPR ).

Kingsley Associates

Where applicable, KGAL uses Kingsley Associates (https://www.kingsleyassociates.com/), 44 Montgomery Street, Suite 1430, San Francisco, CA 94104, USA, for the purpose of conducting surveys. Kingsley Associates is a service provider specialising in the implementation and evaluation of surveys. Under the Privacy Shield, the company has committed to the US Department of Commerce to respect the data protection principles of the European Union and has certified itself. KGAL and its service provider Kingsley Associates use the responses you provide in the survey exclusively for implementation of the survey. Your information will not be shared with other third parties. Once you have completed and submitted the survey, it is no longer possible to access your information and/or edit it. Further information on data protection and data security concerning Kingsley Associates is available on the service provider’s website here.

5. Which legal basis is taken into consideration?

The legal basis for the processing of your personal data for research and statistical purposes is point (a) of Article 6(1) GDPR. In accordance with this, the processing of data is permissible if you consent to this for the purposes of the survey. As the legal basis for data processing is a declaration of consent, you have the right to withdraw consent at any time with immediate effect.

In individual cases, we process your data in order to safeguard justified interests held by us. This applies in particular for data exchange within the Group for management purposes (legal basis point (f) of Article 6(1) GDPR).

6. Where does our data come from?

Personal data is gathered directly from you as part of the survey.

7. Who will receive our data?

Within our company, only the individuals and offices (e.g. the relevant department) that require the data for evaluating the survey receive your personal data. Beyond that, the service providers stated in Section 4 receive your data, depending on the respective survey. We will indicate which company receives the data in each specific case.

8. What data protection rights can you assert?

You can request access to your stored personal data by contacting the data protection officer at the address in section 2. In addition, you can request the correction or erasure of your data under certain circumstances. Furthermore, you may be entitled to request that the processing of your data be restricted and to receive the data you have provided in a structured, commonly used, and machine-readable format. In addition, you have the right to lodge complaints with a supervisory authority for data protection.

The supervisory authority for data protection relevant for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany

Email: poststelle(at)lda.bayern.de

Alternatively, you can also contact the above-named business data protection officer responsible for you at any time. Further information on your rights is provided in Section G. of this data protection statement.

9. What right of objection are you entitled to?

If we process your data to safeguard legitimate interests, you can object to this processing due to reasons arising from your particular situation. We will then no longer process your personal data unless we are able to prove mandatory, legitimate grounds for processing which override your interests, rights and freedoms, or unless processing serves the establishment, exercise or defence of legal claims.

10. How long is your data stored for?

We process and store your personal data for as long as is necessary for the evaluation of the survey, implementation of associated measures, and fulfilment of legal obligations.

We erase your personal data as soon as it is no longer required for the purposes stated above, or when you assert your right to erasure. It could be the case that personal data is stored for the period during which claims could be asserted against our company. In this case, we store the data until the claim has been clarified.

11. Is your data transferred to a third country?

Your personal data is not transferred to a third country. Third countries are states outside the European Economic Area. It cannot be ruled out that the application provider uses technical support services from the USA in individual cases.

12. Are you required to provide data?

Participation in surveys is voluntary. In order to submit a survey successfully, you need to complete certain mandatory fields. These vary from survey to survey, but are always clearly indicated.

13. To what extent do automated individual decision-making or profiling measures take place?

We do not use any automated processing procedures in order to make decisions. This includes profiling.

The applicable data protection law grants you comprehensive data subject rights (rights to access and intervention) with respect to the controller regarding the processing of your personal data; please see below for further details.

1. Right to access pursuant to Article 15 GDPR

In particular, you have a right to access the personal data concerning you and processed by us, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned term of storage and the criteria for determining the term of storage, the existence of a right to rectification, erasure, restriction of processing, objection to processing, the submission of complaints to a supervisory authority, the origin of your data if this has not been collected from you by us, the existence of automated decision-making including profiling and where applicable, meaningful information regarding the involved logic and the scope concerning you and the unintended effects of such processing, as well as your right to be notified of which guarantees pursuant to Article 46 GDPR exist in the event of your data being transferred to third parties.

2. Right to rectification pursuant Article 16 GDPR

You have a right to immediate rectification of incorrect data concerning you and/or the completion of incomplete data concerning you stored by us;

3. Right to erasure pursuant to Article 17 GDPR

You have the right to request the erasure of your personal data in the event of the requirements stated in Article 17(1) GDPR being fulfilled. However, this right does not apply in particular if processing is necessary for the exercising of the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or to establish, exercise or defend legal claims;

4. Right to restriction of processing pursuant to Article 18 GDPR

You have the right to request the restriction of processing of your personal data, as long as the data accuracy that you dispute is checked if you reject erasure of your data due to inadmissible data processing and instead request the restriction of processing of your data, or if you require your data for the establishment, exercise or defence of legal claims after we no longer need this data following the achievement of the relevant purpose, or if you have submitted an objection on grounds of your particular situation in as far as it has not yet been determined whether our justified grounds are overriding;

5. Right to be informed pursuant to Article 19 GDPR

If you have asserted the right to rectification, erasure or restriction of processing with respect to the controller, the controller is required to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves a disproportionate effort. You are entitled to be informed of these recipients.

Right to data portability pursuant to Article 20 GDPR You have the right to receive your personal data which you have provided to us, in a structured, commonly used, and machine-readable format, or to request it is transmitted to another controller, where technically feasible;

6. The right to withdraw consent once issued, pursuant to Article 7(3) GDPR

You have the right to withdraw any issued consent to the processing of data at any time, with immediate effect. In the event of withdrawal, we shall immediately erase the relevant data, unless alternative processing can be supported by a legal basis for processing without consent. Withdrawing consent shall not impact the legality of processing that has taken place on the basis of the consent until withdrawal;

7. Right to lodge complaints pursuant to Article 77 GDPR

If you are of the view that the processing of personal data concerning you breaches the GDPR, you have the right – regardless of any alternative administrative law or judicial legal remedy – to lodge a complaint with a supervisory authority, in particular in the member state of your place of residence, your workplace, or of the location of the suspected breach.

8. Right to object

If, in the context of a weighing of interests, we process your personal data based on our overriding justified interest, you have the right at any time to submit an objection against this processing with immediate effect, for grounds that arise based on your particular situation.

If you make use of your right to object, we shall cease processing the relevant data. However, further processing remains reserved if we are able to prove binding, legitimate grounds for processing, which override your interests, basic rights and basic freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

If your personal data is processed by us in order to undertake direct marketing, you have the right to at any time submit an objection to the processing of personal data concerning you for the purposes of advertising of this type. You may exercise the objection as described above.

If you make use of your right to object, we shall cease processing the relevant data for the purposes of direct marketing.