OUR Privacy policy

OUR PRIVACY NOTICE

This version was machine-translated. In case of doubt, the original German version applies.

As an independent investment and asset manager, we attach great importance to protecting your data and safeguarding your privacy. To ensure that you are fully informed about the collection and use of personal data, please familiarise yourself with the following information. To make it easier for you to find the information relevant to you, we have divided this Privacy Notice into the following sections:

A. Scope
B. Website Visitors
C. Applicants
D. Tenants
E. Investors
F. Your Rights

A. SCOPE

This Privacy Policy applies to all websites, services and offerings for which KGAL GmbH & Co. KG and its subsidiaries, hereinafter also referred to as “KGAL”, are responsible, unless the overall context indicates otherwise. In this sense, the Policy also applies to companies managed by KGAL. The specific data processed and the manner in which it is used depend primarily on the services requested by or agreed with you.

What does data protection cover? At its core, data protection concerns the protection of natural persons in connection with the processing of personal data. What is personal data? Personal data is any information relating to an identified or identifiable natural person, hereinafter referred to as the “data subject”. A natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name or identification number, including an online identifier.

If you have any questions that are not answered by this Privacy Notice, or if you require more detailed information on a particular point, please contact our Data Protection Officer at any time.

Contact details of our Data Protection Officer:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Email: datenschutz(@)kgal.de

Our Privacy Policy does not apply to services offered by other companies or individuals or to other websites linked to our services. Our Privacy Policy does not cover the handling of information by other companies or organisations that advertise our services and may use cookies, pixel tags and other technologies to provide and display relevant advertisements.

If you access an external website from our website via an external link, the external provider may receive information from your browser indicating which of our web pages referred you to its website. The external provider is responsible for this data. Like any other website provider, we are unable to influence this process.

B. WEBSITE VISITORS

KGAL appreciates your visit to our website and your interest in our company and in our products and services. We want you to understand what personal data we collect, when we collect it and how we use it.

1. GENERAL INFORMATION

Use of our website does not require prior confirmation, except for the nationality check in the institutional login area. When you visit our website, we therefore process personal data that you transmit to us automatically by technical means and/or provide when contacting us.

If you have given your consent, we also use services for audience measurement and marketing purposes. The specific services used, the data processed and the recipients to whom it is transferred are described in the sections “Cookies” and “Which services do we use?” below. No processing for analytics or marketing purposes takes place without your consent.

2. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA AND WHO IS THE DATA PROTECTION OFFICER?

KGAL GmbH & Co. KG
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Fax: +49 89 64143-150
Email: kgal(@)kgal.de

and its subsidiaries.

You can contact our Data Protection Officer at:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Email: datenschutz(@)kgal.de

3. WHAT DATA DO WE PROCESS ABOUT YOU AND FOR WHAT PURPOSE?
3.1.1. SERVER LOG FILES

When you visit our website or use our services, the device and internet browser you use to access our website automatically transmit log data to our server. This log data includes, in particular, the name of the file or web page accessed, the volume of data transferred, the type and version of the web browser used, the operating system used, including its type and version, the date and time at which the page was accessed, the referrer URL, meaning the website from which you reached our website by following a link, and the IP address of the requesting device. Once the IP address is no longer technically required to provide access to the online service, it is stored only in truncated, anonymised form for statistical analysis.

Server log files are stored for up to 30 days to ensure the security and stability of the website and are subsequently deleted, unless security-related incidents require a longer retention period.

The data automatically transmitted as described above is collected and analysed exclusively to ensure the proper and optimal presentation of the information provided and for statistical analysis. The legal basis for processing personal data is Article 6(1), first sentence, point (f) of the General Data Protection Regulation, or GDPR.

We are unable to assign the data automatically transmitted to the server to specific natural persons. In principle, it is therefore not possible for us to identify you directly on the basis of this data. However, we would point out that, with the involvement of your internet access provider, it may theoretically be possible for a certain period to identify the owner of the internet connection used to access our website on the basis of the transmitted IP address. Your internet access provider can provide you with information about how long it stores used and assigned IP addresses.

We process personal data such as your name, address, telephone number or email address on this website only for the purpose of safeguarding our legitimate business interests in supporting our investors, prospective clients and/or other business partners. Otherwise, we use data that you provide voluntarily exclusively for the purpose for which you provided it to us. We use your data for other offerings or marketing purposes only if you have also given us your consent to do so.

3.1.2. PRESS DISTRIBUTION LIST | NEWSLETTER

If you subscribe to our email newsletter, we will regularly send you information about our offerings. The only mandatory information required for sending the newsletter is your email address. The provision of any additional data is voluntary and is used to address you personally.

We use a double opt-in procedure to send the newsletter. This means that we will not send you an email newsletter until you have expressly confirmed that you consent to receiving the newsletter. We will then send you a confirmation email asking you to confirm, by clicking on an appropriate link, that you wish to receive newsletters in the future.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Article 6(1), first sentence, point (a) GDPR. When you subscribe to the newsletter, we store the IP address entered by your internet service provider, or ISP, together with the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data collected when you subscribe to the newsletter is used exclusively for promotional communications sent via the newsletter.

You may unsubscribe from the newsletter at any time by using the link provided in the newsletter or by sending an appropriate message to the controller identified above. Once you have unsubscribed, your email address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to use the data for other purposes permitted by law and about which we inform you in this Privacy Policy.

If you use the contact form for our press distribution list to contact us, the data you enter will also be transmitted in encrypted form using SSL to protect you against misuse by third parties. You can recognise an encrypted connection by the browser address bar changing from “http://” to “https://” and by the padlock symbol in your browser. If SSL encryption is activated, the data you transmit to us cannot be read by third parties.

3.1.3. HANDLING OF EMAILS

If you can send a message to KGAL from our website, the transmission is cryptographically encrypted. We use the email address you provide to respond by email with the requested information.

If the content of your message relates to a contractual relationship, we retain the email. The legal basis for processing personal data is Article 6(1), first sentence, point (b) GDPR.

Before sending us an unencrypted email through your internet provider, please bear in mind that its contents may not be protected against unauthorised access, alteration or similar interference on the internet. Please also note that external service providers that filter incoming emails for spam and malware may have access to your email.

3.1.4. DOWNLOADS

Whenever a file is requested from our download offering, access data is stored. Each data record consists of the page from which the file was requested, the name of the file, the date and time of the request, the volume of data transferred, the access status, for example whether the file was transferred or not found, a description of the type of web browser used and the IP address.

3.1.5. CONTACT FORM

If you contact us using the contact form, we process the personal data you provide, such as your name, email address, company, telephone number and the content of your message, in order to handle and respond to your enquiry.

Mandatory fields are identified as such. The provision of any additional information is voluntary. If your enquiry concerns the conclusion or performance of a contract, processing is carried out on the basis of Article 6(1), point (b) GDPR. In all other cases, processing is based on our legitimate interest in handling enquiries efficiently in accordance with Article 6(1), point (f) GDPR.

Your information is transmitted by email to the responsible unit within KGAL and is additionally stored in our website’s content management system so that enquiries can be processed in a traceable manner. Access to stored entries is restricted to authorised employees.

Personal data submitted through the contact form is generally stored for the duration of the handling of your enquiry. If the enquiry does not result in a contractual relationship and there are no statutory retention obligations, the data is deleted once the enquiry has been processed.

If the enquiry relates to an existing contractual relationship or leads to the initiation of a contract, the retention period is determined by the applicable statutory retention obligations.

If the form is provided by a technical service provider, that provider is engaged as a processor in accordance with Article 28 GDPR.

To protect your data, we use TLS encryption that reflects the current state of the art when you visit our website and submit form content.

We use the Cloudflare Turnstile service to protect our forms against misuse.

4. WHO RECEIVES YOUR DATA?

Your enquiries are forwarded to the relevant department within KGAL. We use selected service providers for the technical and organisational implementation of our website. The scope of any data transfer is limited to the minimum necessary.

These processors are contractually required to process the data received exclusively in accordance with our instructions. The requirements of the GDPR are observed. This applies, for example, to data storage. Our certified processor stores the data in secure data centres located within the European Union.

5. COOKIES | GENERAL INFORMATION

To make your visit to our website attractive and enable the use of certain functions, we use cookies on various pages. Cookies are small text files stored on your device, including laptops, tablets and smartphones, when you visit our website. A cookie stores information relating to the specific device used.

Some of the cookies we use are deleted at the end of the browser session, meaning when you close your browser. These are known as session cookies. Other cookies remain on your device and enable us or our partner companies, in the case of third-party cookies, to recognise your browser on your next visit. This means that you do not have to enter information or configure settings again.

When cookies are placed, they collect and process certain user information to varying degrees, such as browser and location data and IP address values. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie.

We use technically necessary cookies on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act, or TDDDG, and, where personal data is processed, on the basis of Article 6(1), point (f) GDPR. We use all other cookies and comparable technologies exclusively with your consent in accordance with Section 25(1) TDDDG and Article 6(1), point (a) GDPR. You may withdraw your consent at any time with future effect through the settings of our consent banner.

The following categories are distinguished on our website:

Necessary: Cookies without which the website cannot function, in particular cookies used to store your language preference and document your consent decision.
Statistics: Cookies used for audience measurement and to analyse the use of our website.
Marketing: Cookies that enable us to measure the success of our advertising activities and create target audiences.

An overview of the cookies used, including their name, provider, purpose, duration and category, is available at any time in the settings of our consent banner.

You can configure your browser to notify you when cookies are placed, allow you to decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or generally. Each browser differs in the way it manages cookie settings. The help menu of your browser explains how to change these settings. Please note that the functionality of our website may be restricted if you do not accept cookies.

We may work with advertising partners who help us make our online offering more relevant and attractive to you. For this purpose, cookies from partner companies may also be stored on your hard drive when you visit our website. These are third-party cookies. If we work with the advertising partners referred to above, you will be informed separately and specifically about the use of such cookies and the scope of the information collected in Section 6 below.

Information on managing cookies in commonly used browsers is available here:

Manage cookies in Microsoft Edge
Manage cookies in Firefox
https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
Manage cookies in Safari

Please note that the functionality of our website may be restricted if you do not accept cookies. Section 6 contains further explanations, including information about the statistics and tracking services used on this website.

5.1.1. CONSENT MANAGEMENT WITH COMPLIANZ

Our website uses the consent technology provided by Complianz to obtain your consent to the storage of certain cookies in your browser or the use of certain technologies and to document that consent in compliance with data protection requirements.

The provider of this technology is Really Simple Plugins B.V., the Netherlands. Further information is available in the Really Simple Plugins privacy statement. The provider is referred to below as “Complianz”.

When you enter our website, cookies with names beginning with “cmplz_” are stored in your browser. These cookies store the consent you have given or withdrawn for each category, the status of the banner and the version of the Privacy Notice to which you consented. These cookies are stored for 365 days. The data is not transferred to the provider of the consent technology.

The collected data is stored until you ask us to delete it, delete the cookies yourself or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected.

The consent technology is used to obtain and demonstrate the legally required consent for the use of cookies. The legal basis is Article 6(1), point (c) GDPR.

6. WHICH SERVICES DO WE USE?
6.1.1. GOOGLE TAG MANAGER

We use Google Tag Manager on our website. The provider is Google Ireland Limited, “Google”, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a technical management tool that enables us to integrate and control the analytics and marketing services described below. The Tag Manager itself does not create profiles, store cookies or collect personal data for its own purposes. It is used exclusively to trigger other services that may themselves collect data.

When the container is loaded, your IP address is transmitted to Google because this is necessary for technical delivery. The container is blocked by our consent tool and is loaded only after you have given the corresponding consent.

The legal basis is your consent in accordance with Article 6(1), point (a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time. The information in the Google Analytics section applies accordingly to transfers to third countries and the safeguards used for such transfers.

Further information is available in the Google Privacy Policy.

6.1.2. GOOGLE ANALYTICS 4

This website uses functions of the Google Analytics web analytics service in the Google Analytics 4 version. The provider is Google Ireland Limited, “Google”, Gordon House, Barrow Street, Dublin 4, Ireland. The service is integrated through the Google Tag Manager described above.

Google Analytics enables us to analyse the behaviour of website visitors. We receive various usage data, such as page views, time spent on pages, operating systems used and the user’s origin. This data is assigned to the respective user device. It is not assigned to a user ID.

Google Analytics uses technologies that enable the user to be recognised for the purpose of analysing user behaviour, such as cookies or device fingerprinting. For this purpose, the “_ga” and “ga” cookies are placed, each with a duration of two years. The information collected by Google about the use of this website is generally transferred to and stored on a Google server.

In Google Analytics 4, IP addresses are truncated at the point of collection within the European Union and are not stored permanently. Separate activation of IP anonymisation is not required. According to the provider, complete IP addresses are not stored.

This service is used on the basis of your consent in accordance with Article 6(1), point (a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time.

Transfers of data to third countries are based on standard contractual clauses and/or the EU-US Data Privacy Framework. You can check the provider’s current certification status on the Data Privacy Framework website.

Further information about how Google Analytics handles user data is available in the Google Analytics privacy information.

6.1.3. LINKEDIN INSIGHT TAG

We use the LinkedIn Insight Tag on our website. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. It is integrated through Google Tag Manager.

This service enables us to measure whether visitors who reached our website through an advertisement on LinkedIn perform a particular action on our website, known as conversion measurement. The service also enables us to create target audiences for further advertising activities on LinkedIn. We receive only aggregated analyses from LinkedIn that cannot be attributed to individual persons.

When you access our website, your browser establishes a connection to LinkedIn servers. Your IP address and information about your device and usage behaviour are transmitted to LinkedIn. LinkedIn places cookies from the linkedin.com domain. If you are logged in to LinkedIn, LinkedIn may associate your visit to our website with your user account.

The service is loaded only after you have consented to the “Marketing” category. The legal basis is Article 6(1), point (a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time.

Transfers of data to third countries are based on standard contractual clauses and/or the EU-US Data Privacy Framework. Further information is available in the LinkedIn Privacy Policy.

6.1.4. CLOUDFLARE TURNSTILE

We use the Turnstile service to protect our forms against automated submissions and misuse. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Turnstile checks in the background whether an entry in our contact form is made by a human or an automated program. For this purpose, technical connection data from your device, in particular your IP address, information about the browser used and your behaviour while entering information, is transmitted to and analysed by Cloudflare. The data is not analysed for advertising purposes.

The service is loaded before consent is given because it would otherwise be unable to perform its protective function. The legal basis is our legitimate interest in the security of our website and the prevention of abusive enquiries in accordance with Article 6(1), point (f) GDPR. Reading and storing information on your device is strictly necessary for your expressly requested use of the form within the meaning of Section 25(2), no. 2 TDDDG. Cookies are placed as part of the service.

Transfers of data to the United States are based on standard contractual clauses and/or the EU-US Data Privacy Framework. Further information is available in the Cloudflare Privacy Policy.

6.1.5. GOOGLE MAPS

This website uses the Google Maps map service. The provider is Google Ireland Limited, “Google”, Gordon House, Barrow Street, Dublin 4, Ireland. This service enables us to integrate maps into our website.

To use Google Maps functions, it is necessary to store your IP address. This information is generally transferred to and stored on a Google server in the United States. The provider of this website has no influence over this data transfer.

When Google Maps is activated, Google may use Google Fonts to ensure the consistent display of fonts. When you access Google Maps, your browser loads the required web fonts into its browser cache so that text and fonts are displayed correctly.

Google Maps is used in the interest of presenting our online offerings in an attractive manner and making the locations specified on our website easy to find. This constitutes a legitimate interest within the meaning of Article 6(1), point (f) GDPR. If corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1), point (a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG.

You may withdraw your consent at any time. Transfers of data to the United States are based on the European Commission’s standard contractual clauses.

Further details are available in:

Google GDPR Controller Terms
Google Standard Contractual Clauses
Google Privacy Policy
6.1.6. EXTERNAL HOSTING

This website is hosted externally. Personal data collected on this website is stored on the servers of the hosting provider or providers. This may include, in particular, IP addresses, contact enquiries, metadata and communication data, contractual data, contact details, names, website access data and other data generated through a website.

External hosting is used for the performance of contracts with our prospective and existing customers in accordance with Article 6(1), point (b) GDPR and in the interest of providing our online offering securely, quickly and efficiently through a professional provider in accordance with Article 6(1), point (f) GDPR.

If corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1), point (a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG. You may withdraw your consent at any time.

Our hosting provider or providers process your data only to the extent necessary to fulfil their service obligations and follow our instructions regarding this data.

We use the following hosting provider:

Trafo2 GmbH
Alfredstraße 356
D-45133 Essen
Visit the Trafo2 website

6.1.7. SOCIAL MEDIA | REDIRECT BUTTONS

Our websites contain redirect buttons that you can click to share content from our website on social media platforms such as Facebook, operated by Meta, X, formerly Twitter, LinkedIn and Xing. These buttons are simple links. Merely accessing our website does not cause them to transmit personal data to social media providers.

This should be distinguished from the LinkedIn Insight Tag marketing service described above, which transmits data to LinkedIn if you have given your consent.

If you click a redirect button, the social media provider collects personal data from you directly. However, we cannot rule out the possibility that the operators of social networks may determine that you were redirected from our website, viewed our company profile on the network and possibly interacted with it, and that they may use this information for their own advertising purposes. Before clicking a redirect button, please read the privacy information of the relevant social media provider through which you wish to share content.

We also collect data that you voluntarily provide to us through social media platforms such as Facebook, operated by Meta, X, formerly Twitter, Xing or LinkedIn. If you respond to emails or surveys directly on these social media pages, your data is collected both on the social media platform and on our platform.

Further information about the purpose and scope of the collection, processing and use of data by the respective social media providers is available in their privacy policies:

Facebook and Meta Privacy Policy
X Privacy Policy
Xing Privacy Policy
LinkedIn Privacy Policy
7. WHAT DATA PROTECTION RIGHTS CAN YOU EXERCISE?

You may withdraw your consent to the storage of your data and email address and their use for sending the newsletter at any time, for example by using the “unsubscribe” link in the newsletter.

You may request information about the personal data stored about you at the address stated above. You may also request the rectification or deletion of your data. You may have the right to restrict the processing of your data and the right to receive the data you have provided in a structured, commonly used and machine-readable format. You also have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision, BayLDA
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de

Alternatively, you may contact the Data Protection Officer of the KGAL Group at any time.

8. WHAT RIGHT TO OBJECT DO YOU HAVE?

For further details about your rights, please refer to Section F of this Privacy Notice.

9. HOW LONG WILL YOUR DATA BE STORED?

The period for which personal data is stored is determined by the relevant statutory retention period, including retention periods under commercial and tax law. Once the applicable period has expired, the data is routinely deleted, provided that it is no longer required for the performance or initiation of a contract and we have no legitimate interest in continuing to store it.

10. WILL YOUR DATA BE TRANSFERRED TO A THIRD COUNTRY?

If you have consented to the use of the analytics and marketing services described above, personal data may be transferred to recipients in third countries. This applies in particular to Google Ireland Limited, LinkedIn Ireland Unlimited Company and Cloudflare, Inc., whose parent companies are based in the United States.

Transfers are based on standard contractual clauses and/or the EU-US Data Privacy Framework.

11. PROFILING MEASURES

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

12. DATA SECURITY

The data disclosed to us about you is processed in accordance with statutory provisions. KGAL employees treat the personal information you provide when visiting our website as confidential. All KGAL employees are required in writing to maintain data confidentiality. The Data Protection Officer and Internal Audit regularly review compliance with data protection requirements.

We have implemented the necessary technical and organisational measures to ensure a high level of protection for your personal data. KGAL’s data processing network is protected from the outside world by a firewall system reflecting the current state of the art. Internal KGAL applications are accessible to authorised persons only through a login process using an individual user ID and password. Within the applications, user rights are restricted according to business requirements through authorisation systems.

C. APPLICANTS

We appreciate your interest in our company and your application or previous application for a position with us. The following information explains how we process your personal data in connection with your application.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA AND WHO IS THE DATA PROTECTION OFFICER?

The controller responsible for processing your data is the company advertising the position. Depending on the position for which you are applying or have applied, this is:

KGAL GmbH & Co. KG
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Fax: +49 89 64143-150
Email: kgal(@)kgal.de

or one of its subsidiaries.

Further information about our company, the persons authorised to represent it and additional contact options can be found in the legal notice on our website.

You can contact our Data Protection Officer at:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Email: datenschutz(@)kgal.de

2. WHAT DATA DO WE PROCESS ABOUT YOU?

The categories of personal data processed include, in particular:

your master data, such as your first name, surname, name suffixes and nationality;
contact details, such as your private address, telephone number and email address; and
all data relating to the application process, such as cover letters, references, questionnaires, interviews, qualifications and previous professional activities.

If you voluntarily disclose special categories of personal data in your application or during the application process, such as health data, religious affiliation or degree of disability, this data is processed only if you have consented or a statutory provision permits the processing.

3. FOR WHAT PURPOSES IS YOUR DATA PROCESSED?

Your data is processed to conduct and administer the application process and to assess your suitability for the position concerned. Processing your data is necessary to enable us to decide whether to establish a contractual relationship.

4. WHAT IS THE APPLICABLE LEGAL BASIS?

The legal basis for processing your personal data in this application process is Article 6(1), first sentence, point (b) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act, or BDSG. These provisions permit the processing of data that is necessary for a decision on establishing an employment relationship.

Processing may also be based on other legislation, such as the German Works Constitution Act and the German General Equal Treatment Act, as well as statutory provisions relating to money laundering, taxation and social security.

If processing is based on consent, you have the right to withdraw your consent at any time with future effect.

In individual cases, we process your data to safeguard our legitimate interests or those of third parties, such as public authorities. This applies in particular to the investigation of criminal offences under Article 6(1), first sentence, point (f) GDPR and, in the context of employment relationships, in conjunction with Section 26(1), second sentence, BDSG, or to intra-group data transfers for administrative purposes.

The processing of special categories of personal data, such as health data, is based on your consent under Article 9(2), point (a) GDPR and, in the context of employment relationships, in conjunction with Section 26(2) BDSG, unless statutory authorisations such as Article 9(2), point (b) GDPR in conjunction with Section 26(3) BDSG apply.

5. WHERE DOES YOUR DATA COME FROM?

As a rule, your personal data is collected directly from you during the application process. We may also receive data from third parties, such as recruitment agencies, to whom you have provided your data for onward transmission.

6. WHO RECEIVES YOUR DATA?

Within our company, only those persons and units that need your personal data to decide whether to enter into a contract and to fulfil our pre-contractual, contractual and statutory obligations receive it. These may include the relevant specialist department and the Works Council.

The application process is conducted primarily by KGAL GmbH & Co. KG itself, which means that your data is also processed there.

7. WHAT DATA PROTECTION RIGHTS CAN YOU EXERCISE?

You may request information about the personal data stored about you at the address stated above. Under certain conditions, you may also request the rectification or deletion of your data.

You may have the right to restrict the processing of your data and the right to receive the data you have provided in a structured, commonly used and machine-readable format. You also have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision, BayLDA
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de

Alternatively, you may contact the competent company Data Protection Officer identified above at any time. For further details about your rights, please refer to Section F of this Privacy Notice.

8. WHAT RIGHT TO OBJECT DO YOU HAVE?

If we process your data to safeguard legitimate interests, you may object to this processing on grounds relating to your particular situation.

We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims.

9. HOW LONG WILL YOUR DATA BE STORED?

If no contractual relationship is established, we delete your personal data six months after the application process has been completed. This does not apply where statutory provisions prevent deletion, continued storage is required for evidentiary purposes or you have consented to a longer storage period.

10. WILL YOUR DATA BE TRANSFERRED TO A THIRD COUNTRY?

Your personal data will not be transferred to a third country. Third countries are countries outside the European Economic Area.

11. TO WHAT EXTENT ARE AUTOMATED INDIVIDUAL DECISIONS OR PROFILING USED?

We do not use automated processing procedures to make decisions. This includes profiling.

D. TENANTS
1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA AND WHO IS THE DATA PROTECTION OFFICER?

General information: The controller responsible for processing your data is your landlord. Your landlord is the party to the tenancy agreement concluded with you, to which we refer in this context. Please use the name of the landlord together with the postal address known to you.

If you wish to contact one of the management companies known to you, this is:

KGAL GmbH & Co. KG
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Fax: +49 89 64143-150
Email: kgal(@)kgal.de

or one of its subsidiaries.

You can contact our Data Protection Officer at:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Email: datenschutz(@)kgal.de

2. WHAT DATA DO WE PROCESS ABOUT YOU?

Relevant personal data includes:

personal details, such as your name, address and other contact details, date, name and place of birth, occupation, marital status and nationality;
identification data, such as identity document data;
authentication data, such as a specimen signature;
other master and contractual data, such as information about existing contracts, payment data and the role of the data subject, for example as a tenant;
order data, such as payment instructions;
data resulting from the performance of our contractual obligations, such as transaction data relating to payments;
information about your financial circumstances, such as salary and creditworthiness data;
data relating to tenant contacts and case processing; and
other data comparable to the categories referred to above.
3. FOR WHAT PURPOSES IS YOUR DATA PROCESSED?

Your personal data is processed to provide letting services performed at your request, execute your instructions and carry out all activities required for the operation and management of real estate.

The purposes of processing include, among other things, service charge settlements, maintenance and repairs and the execution of transactions. Further details regarding the purposes of processing can be found in the relevant contractual documents.

4. WHAT IS THE LEGAL BASIS FOR PROCESSING?

Processing is carried out for the performance of the tenancy agreement and therefore on the basis of Article 6(1), first sentence, point (b) GDPR.

Where necessary, we process your data beyond the actual performance of the contract to safeguard our legitimate interests or those of third parties in accordance with Article 6(1), first sentence, point (f) GDPR. This may include:

consulting and exchanging data with credit agencies to assess credit or default risks;
asserting legal claims and defending ourselves in legal disputes;
ensuring information technology security and operations;
preventing and investigating criminal offences;
using video surveillance to collect evidence in connection with criminal offences and thereby protect tenants and employees;
exercising our domiciliary rights; and
protecting buildings and facilities.

If you have given us consent to process personal data for specific purposes, the lawfulness of this processing is based on your consent in accordance with Article 6(1), first sentence, point (a) GDPR. Consent may be withdrawn at any time. Please note that withdrawal applies only with future effect.

We are also subject to various legal obligations, meaning statutory requirements under Article 6(1), first sentence, point (c) GDPR, including requirements under money laundering and tax legislation and regulatory requirements.

The purposes of processing include creditworthiness assessments, identity and age verification, fraud and money-laundering prevention, compliance with tax monitoring and reporting obligations, the assessment and management of risks and the provision of information to public authorities.

5. WHERE DOES YOUR DATA COME FROM?

We process personal data that we receive from you within the scope of our business relationship, for example through the tenancy agreement.

Where necessary to provide our services, we also process personal data that we have lawfully received, and may lawfully receive in the future, from partners responsible for you or other third parties, such as SCHUFA, for example on the basis of your consent. This may be necessary to execute instructions, perform contracts or act on the basis of consent given by you.

We also process personal data that we have lawfully obtained from publicly accessible sources, such as land registers, commercial and association registers, the press, the internet and other media.

6. WHO RECEIVES YOUR DATA?

Within KGAL, those units that require access to your data to fulfil contractual and statutory obligations receive such access.

Service providers, vicarious agents and processors engaged by us under Article 28 GDPR may also receive data for the purposes specified above, provided that they comply with data protection requirements. These include companies in the areas of property management, information technology services, telecommunications, debt collection, advisory services, consulting and address verification.

We may disclose information about you only where this is permitted or required by law, where you have given your consent or where we are authorised to provide information.

Under these conditions, recipients of personal data may include:

public bodies and institutions, such as tax authorities and law enforcement authorities, where a statutory or official obligation exists;
credit institutions, financial service providers or comparable institutions to which we transfer personal data for the purpose of conducting the business relationship with you, such as guarantors and credit agencies; and
other companies within the KGAL Group, insofar as this is necessary for the provision of services.
7. WHAT DATA PROTECTION RIGHTS CAN YOU EXERCISE?

Every data subject has:

the right of access under Article 15 GDPR;
the right to rectification under Article 16 GDPR;
the right to erasure under Article 17 GDPR;
the right to restriction of processing under Article 18 GDPR; and
the right to data portability under Article 20 GDPR.

The restrictions under Sections 34 and 35 BDSG apply to the rights of access and erasure. You also have the right to lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR in conjunction with Section 19 BDSG.

You may withdraw consent to the processing of personal data at any time. This also applies to consent given before the GDPR became applicable, meaning before 25 May 2018. Please note that withdrawal applies only with future effect.

You may submit a complaint to the Data Protection Officer of the KGAL Group identified above or to a data protection supervisory authority.

The supervisory authority responsible for companies based in Bavaria is:

Bavarian State Office for Data Protection Supervision, BayLDA
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de

8. WHAT RIGHT TO OBJECT DO YOU HAVE?

If we process your data to safeguard legitimate interests, you may object to this processing on grounds relating to your particular situation.

9. HOW LONG WILL YOUR DATA BE STORED?

We process and store your personal data for as long as necessary to fulfil our contractual and statutory obligations. Our business relationship is a continuing contractual relationship intended to last for a period of years.

We are also subject to various retention and documentation obligations arising, among other things, from the German Commercial Code, or HGB, and the German Fiscal Code, or AO. The applicable retention and documentation periods may extend for up to ten years beyond the end of the business relationship or pre-contractual legal relationship.

The storage period is also determined by statutory limitation periods. Under Sections 195 et seq. of the German Civil Code, or BGB, these periods are generally three years but may be up to thirty years in certain cases.

We delete your personal data as soon as it is no longer required for the purposes specified above. Personal data may nevertheless be retained for the period during which claims can be asserted against our company.

We also store your personal data where we are legally required to do so. Corresponding documentation and retention obligations arise, among other things, from the German Commercial Code, the German Fiscal Code and the German Money Laundering Act. The relevant retention periods may therefore be up to ten years.

10. WILL YOUR DATA BE TRANSFERRED TO A THIRD COUNTRY?

Personal data is transferred to bodies in countries outside the European Union or European Economic Area, known as third countries, only if this is necessary to execute your instructions, for example a payment instruction to a third country. Otherwise, personal data is not transferred to third countries.

In connection with remote maintenance of standard information technology components, it cannot be ruled out that, in rare individual cases and for troubleshooting purposes, an information technology service provider from a third country, such as the United States, may receive controlled and restricted access to personal data. Where required by law, we will inform you separately about the details.

If it is necessary to transfer personal data to service providers in third countries, this will take place only if the European Commission has confirmed an adequate level of data protection or other appropriate safeguards are in place, such as binding corporate rules or European Union standard contractual clauses.

11. ARE YOU REQUIRED TO PROVIDE DATA?

Within the scope of the tenancy relationship, you are required to provide only the personal data necessary to establish, conduct and terminate the business relationship or which we are legally required to collect.

Without this data, we will generally have to refuse to conclude the contract or execute the instruction, or may no longer be able to perform an existing contract and may have to terminate it.

12. TO WHAT EXTENT IS AUTOMATED INDIVIDUAL DECISION-MAKING USED?

As a general rule, we do not use fully automated decision-making within the meaning of Article 22 GDPR to establish or conduct the business relationship.

If we use such procedures in individual cases, we will inform you separately where required by law.

13. TO WHAT EXTENT IS YOUR DATA USED FOR PROFILING?

We do not process your data for the purpose of automatically evaluating specific personal aspects.

E. INVESTORS
1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA AND WHO IS THE DATA PROTECTION OFFICER?

KGAL GmbH & Co. KG
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Fax: +49 89 64143-150
Email: kgal(@)kgal.de

or one of its subsidiaries.

You can contact our Data Protection Officer at:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone: +49 89 64143-0
Email: datenschutz(@)kgal.de

2. WHAT DATA DO WE PROCESS ABOUT YOU?

The categories of personal data processed include, in particular:

your master data, such as your first name, surname, name suffixes and nationality;
contact details, such as your private address, telephone number and email address;
data relating to your investment in one of our products, such as limited partnership capital, liability amount, capital calls and distributions; and
data required for payment and other processing, such as bank details, tax number and competent tax office.
3. FOR WHAT PURPOSES IS YOUR DATA PROCESSED?

Your data is processed for the implementation and administration of the investment offering.

4. WHAT IS THE APPLICABLE LEGAL BASIS?

The legal basis for processing your personal data is Article 6(1), first sentence, point (b) GDPR. This permits the processing of data necessary for the performance of a contract.

Processing may also be based on other legislation and statutory provisions, such as money-laundering and tax legislation.

If processing is based on consent, you have the right to withdraw your consent at any time with future effect.

In individual cases, we process your data to safeguard our legitimate interests or those of third parties, such as public authorities. This applies in particular to the investigation of criminal offences on the basis of Article 6(1), first sentence, point (f) GDPR or to intra-group data transfers for administrative purposes.

5. WHERE DOES YOUR DATA COME FROM?

As a rule, your personal data is collected directly from you. We may also receive data from third parties, such as intermediaries, to whom you have provided your data for onward transmission.

6. WHO RECEIVES YOUR DATA?

Within our company, only those persons and units, such as the relevant specialist department, that require your personal data to decide whether to enter into a contract and to fulfil our pre-contractual, contractual and statutory obligations receive it.

Other recipients include parties engaged to implement and administer the investment, in particular administrators, tax advisers, auditors and domestic and foreign tax authorities.

7. WHAT DATA PROTECTION RIGHTS CAN YOU EXERCISE?

You may request information about the personal data stored about you at the address stated above. Under certain conditions, you may also request the rectification or deletion of your data.

The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision, BayLDA
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de

Alternatively, you may contact the competent company Data Protection Officer identified above at any time. For further details about your rights, please refer to Section F of this Privacy Notice.

8. WHAT RIGHT TO OBJECT DO YOU HAVE?

If we process your data to safeguard legitimate interests, you may object to this processing on grounds relating to your particular situation.

9. HOW LONG WILL YOUR DATA BE STORED?

10. WILL YOUR DATA BE TRANSFERRED TO A THIRD COUNTRY?

Your personal data will not be transferred to a third country. Third countries are countries outside the European Economic Area.

11. ARE YOU REQUIRED TO PROVIDE DATA?

Within the scope of the investment relationship, you are required to provide only the personal data necessary to establish, conduct and terminate the investment or which we are legally required to collect.

Without this data, we will generally have to refuse to conclude the investment or execute the instruction, or may no longer be able to perform an existing contract and may have to terminate it.

12. TO WHAT EXTENT ARE AUTOMATED INDIVIDUAL DECISIONS OR PROFILING USED?

We do not use automated processing procedures to make decisions. This includes profiling.

F. YOUR RIGHTS

Applicable data protection law grants you comprehensive rights as a data subject in relation to the controller’s processing of your personal data. These include rights of access and intervention, about which we inform you below.

1. RIGHT OF ACCESS UNDER ARTICLE 15 GDPR

In particular, you have the right to obtain information about:

the personal data concerning you that we process;
the purposes of processing;
the categories of personal data processed;
the recipients or categories of recipients to whom your data has been or will be disclosed;
the envisaged storage period or the criteria used to determine that period;
the existence of a right to rectification or erasure, restriction of processing or objection to processing;
the right to lodge a complaint with a supervisory authority;
the source of your data where it was not collected directly from you by us;
the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you; and
the safeguards under Article 46 GDPR that apply when your data is transferred to third countries.
2. RIGHT TO RECTIFICATION UNDER ARTICLE 16 GDPR

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data stored by us.

3. RIGHT TO ERASURE UNDER ARTICLE 17 GDPR

You have the right to request the erasure of your personal data where the conditions of Article 17(1) GDPR are met.

However, this right does not apply, in particular, where processing is necessary for exercising the right to freedom of expression and information, complying with a legal obligation, reasons of public interest or the establishment, exercise or defence of legal claims.

4. RIGHT TO RESTRICTION OF PROCESSING UNDER ARTICLE 18 GDPR

You have the right to request restriction of the processing of your personal data:

while the accuracy of the data contested by you is being verified;
where you oppose the erasure of your data due to unlawful processing and request restriction of its use instead;
where you require the data for the establishment, exercise or defence of legal claims after we no longer require it for the purposes of processing; or
where you have objected to processing on grounds relating to your particular situation, pending verification of whether our legitimate grounds override yours.
5. RIGHT TO NOTIFICATION UNDER ARTICLE 19 GDPR

If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller is required to communicate that rectification, erasure or restriction of processing to every recipient to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed about those recipients.

Right to data portability under Article 20 GDPR: You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller where technically feasible.

6. RIGHT TO WITHDRAW CONSENT UNDER ARTICLE 7(3) GDPR

You have the right to withdraw consent previously given for the processing of data at any time with future effect.

If you withdraw your consent, we will delete the data concerned without undue delay, unless further processing can be based on a legal basis that does not require consent.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

7. RIGHT TO LODGE A COMPLAINT UNDER ARTICLE 77 GDPR

If you believe that the processing of personal data relating to you infringes the GDPR, you have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority.

This applies in particular to a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

8. RIGHT TO OBJECT

If, as part of a balancing of interests, we process your personal data on the basis of our overriding legitimate interest, you have the right at any time to object to this processing with future effect on grounds relating to your particular situation.

If you exercise your right to object, we will stop processing the data concerned. However, we may continue processing if we can demonstrate compelling legitimate grounds for the processing that override your interests, fundamental rights and freedoms, or if the processing is required for the establishment, exercise or defence of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing. You may exercise your objection as described above.

If you exercise your right to object, we will stop processing the data concerned for direct marketing purposes.

Last updated: September 2026