OUR Privacy policy

This version was machine-translated. In case of doubt, the original German version applies.

OUR PRIVACY NOTICE

As an independent investment and asset manager, we attach great importance to protecting your data and safeguarding your privacy. To ensure that you are fully informed about the collection and use of personal data, please familiarise yourself with the information below. To help you find the information relevant to you, we have divided it into the following sections:

A. Scope
B. Website Visitors
C. Applicants
D. Tenants
E. Investors
F. Your Rights

A. Scope

This Privacy Policy applies to all websites, services and offerings for which KGAL GmbH & Co. KG and its subsidiaries (hereinafter also referred to as “KGAL”) are responsible, unless the overall context indicates otherwise. In this sense, the Policy also applies to companies managed by KGAL. The specific data processed and the manner in which it is used depend primarily on the services you request or agree with us.

What does data protection cover? At its core, data protection concerns the protection of natural persons when personal data is processed. What is personal data? It is any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). A natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name or identification number (including an online identifier).

If you have any questions that are not answered by this Privacy Policy, or if you would like more detailed information on any point, please contact our Data Protection Officer at any time.

Contact details of our Data Protection Officer:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Email: datenschutz(>@<)kgal.de

Our Privacy Policy does not apply to services offered by other companies or individuals, or to other websites linked to our services. It does not cover how other companies or organisations handle information when advertising our services and, where applicable, using cookies, pixel tags and other technologies to provide and display relevant advertisements.

If you access an external website from our site via an external link, your browser may inform the external provider which of our web pages referred you to it. The external provider is responsible for this data. Like any other website provider, we are unable to influence this process.

B. WEBSITE VISITORS

KGAL appreciates your visit to our website and your interest in our company, products and services. We want you to know what personal data we collect, when we collect it and how we use it.

GENERAL INFORMATION

Use of our website does not require prior confirmation, except for the nationality check in the institutional login area. When you visit our website, we therefore process personal data that you transmit to us automatically for technical reasons and/or provide when contacting us. Where you have given your consent, we also use services for audience measurement and marketing purposes. The services used, the data processed and the recipients of such data are described in the sections “Cookies” and “Which services do we use?” below. No data is processed for analytics or marketing purposes without your consent.

2. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA AND WHO IS THE DATA PROTECTION OFFICER?

KGAL GmbH & Co. KG
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Fax +49 89 64143-150
Email kgal(>@<)kgal.de

and its subsidiaries.

You can contact our Data Protection Officer at:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Email: datenschutz(>@<)kgal.de

3. WHAT DATA DO WE PROCESS ABOUT YOU AND FOR WHAT PURPOSE?

3.1.1. SERVER LOG FILES

When you visit our website or use our services, the device and internet browser used to access our website automatically transmit log data to our server. This log data includes, in particular, the name of the requested file (web page), the volume of data transferred, the type and version of the web browser, the operating system used (type and version), the date and time of access, the referrer URL (the website from which you reached our website via a link) and the IP address of the requesting device. Once the IP address is no longer technically required to provide the website, it is stored only in truncated (anonymised) form for statistical analysis. Server log files are stored for up to 14 days to ensure the security and stability of the website and are then deleted, unless security-related events require longer retention.

The data transmitted automatically as described above is collected and analysed exclusively to ensure the proper and optimal presentation of the information provided and for statistical analysis. The legal basis for processing personal data is Article 6(1), sentence 1, point (f) GDPR. We are unable to attribute the data automatically transmitted to the server to specific natural persons; generally, therefore, you cannot be identified directly from this data. However, with the cooperation of your internet access provider, it may theoretically be possible for a limited period to identify the holder of the internet connection used to access our site from the transmitted IP address. Your internet access provider can inform you how long used and assigned IP addresses are stored.

We process personal data such as names, addresses, telephone numbers or email addresses on this website only to safeguard our legitimate business interests in supporting our investors, prospective clients and/or other business partners. Otherwise, we use data you provide voluntarily solely for the purpose for which you supplied it. We use your data for other offerings or marketing purposes only if you have also consented to such use.

3.1.2. PRESS DISTRIBUTION LIST | NEWSLETTER

If you subscribe to our email newsletter, we will regularly send you information about our offerings. The only mandatory information required is your email address. Any additional data is provided voluntarily and is used to address you personally. We use a double opt-in procedure. This means that we will send you an email newsletter only after you have expressly confirmed that you wish to receive it. We will send you a confirmation email asking you to click a link to confirm that you wish to receive newsletters in future.

By activating the confirmation link, you consent to our use of your personal data in accordance with Article 6(1), sentence 1, point (a) GDPR. When you subscribe, we store the IP address entered by your internet service provider and the date and time of registration so that any subsequent misuse of your email address can be traced. Data collected when you subscribe is used exclusively for promotional communications via the newsletter.

You may unsubscribe at any time using the link provided in the newsletter or by sending a message to the controller named above. After you unsubscribe, your email address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this scope where permitted by law and explained in this Policy.

If you use the contact form for the press distribution list, the data entered is also transmitted in encrypted form (SSL) to protect you against misuse by third parties. An encrypted connection is indicated by the change from “http://” to “https://” in the browser address bar and by the padlock symbol. When SSL encryption is enabled, third parties cannot read the data you transmit to us.

3.1.3. HANDLING EMAILS

If our website enables you to send a message to KGAL, the transmission is cryptographically encrypted. We use the email address you provide to reply by email with the requested information.

If your message relates to a contractual relationship, we retain the email. The legal basis for processing personal data is Article 6(1), sentence 1, point (b) GDPR. Before sending an unencrypted email through your internet provider, please note that its content may not be protected against unauthorised access, alteration or similar risks on the internet. Please also note that external service providers that filter incoming emails for spam and malware may access your email.

3.1.4. DOWNLOADS

Each time a file is requested from our download area, access data is stored. Each record consists of the page from which the file was requested, the file name, the date and time of the request, the volume of data transferred, the access status (file transferred, file not found, etc.), a description of the web browser used and the IP address.

3.1.5. CONTACT FORM

If you contact us via the contact form, we process the personal data you provide (for example, name, email address, company, telephone number and the content of your message) to handle and respond to your enquiry.

Mandatory fields are marked accordingly. Any additional information is provided voluntarily. Where your enquiry concerns the conclusion or performance of a contract, processing is based on Article 6(1), point (b) GDPR. Otherwise, processing is based on our legitimate interest in handling enquiries efficiently pursuant to Article 6(1), point (f) GDPR.

Your information is sent by email to the responsible KGAL department and is also stored in our website’s content management system so that enquiries can be processed transparently. Only authorised employees have access to the stored entries.

Personal data submitted through the contact form is generally stored for the duration of the processing of your enquiry. If the enquiry does not result in a contractual relationship and no statutory retention obligations apply, the data is deleted once processing has been completed.

If the enquiry relates to an existing contractual relationship or leads to the initiation of a contract, the retention period is governed by statutory retention obligations. Where the form is provided by a technical service provider, that provider is engaged as a processor in accordance with Article 28 GDPR.

To protect your data when you visit our website and submit form content, we use TLS encryption that reflects the current state of the art. We use Cloudflare Turnstile to protect our forms against misuse.

4. WHO RECEIVES YOUR DATA?

Your enquiries are forwarded to the relevant KGAL department. We use selected service providers for the technical and organisational operation of our website. Data transfers are limited to the minimum necessary. These processors are contractually obliged to process the data received solely in accordance with our instructions. The requirements of the GDPR are observed. This applies, for example, to data storage. Our certified processor stores the data in secure data centres located in the European Union.

5. COOKIES | GENERAL INFORMATION

To make our website attractive and enable you to use certain functions, we use cookies on various pages. Cookies are small text files stored on your device, including laptops, tablets and smartphones, when you visit our site. They contain information associated with the specific device used.

Some cookies are deleted when the browser session ends, i.e. after you close your browser (session cookies). Other cookies remain on your device and enable us or our partner companies (third-party cookies) to recognise your browser on your next visit (persistent cookies). This means you do not have to re-enter information or settings.

When cookies are set, they collect and process certain user information to varying extents, such as browser and location data and IP address values. Persistent cookies are automatically deleted after a specified period, which varies depending on the cookie.

We use strictly necessary cookies on the basis of Section 25(2) TDDDG and, where personal data is processed, Article 6(1), point (f) GDPR. We use all other cookies and comparable technologies only with your consent pursuant to Section 25(1) TDDDG and Article 6(1), point (a) GDPR. You may withdraw your consent at any time with effect for the future via the settings in our consent banner.

Our website distinguishes between the following categories:

Necessary: Cookies without which the website cannot function, in particular those used to store your language preference and document your consent decision.
• Statistics: Cookies used for audience measurement to analyse use of our website.
• Marketing: Cookies that enable us to measure the success of our advertising activities and create target groups.

An overview of the cookies used, including their name, provider, purpose, duration and category, is available at any time in the settings of our consent banner.

You can configure your browser to notify you when cookies are set and decide whether to accept them individually, or to exclude the acceptance of cookies in certain cases or generally. Each browser manages cookie settings differently. The help menu of your browser explains how to change the settings. Please note that rejecting cookies may restrict the functionality of our website.

We may work with advertising partners that help us make our online offering more relevant to you. In such cases, cookies from partner companies may also be stored on your hard drive when you visit our website. If we work with such advertising partners, you will be informed separately in section 6 below about the use of these cookies and the scope of the information collected.

You can configure your browser to notify you when cookies are set and decide whether to accept them individually, or to exclude the acceptance of cookies in certain cases or generally. Each browser manages cookie settings differently. The help menu explains how to change the settings. Information for common browsers is available at the following links:

Edge: https://support.microsoft.com/de-de/edge/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
Opera: https://blogs.opera.com/germany/2016/03/cookies-aktivieren-opera/
Safari: https://support.apple.com/de-de/guide/deployment/depf7d5714d4/web

Please note that rejecting cookies may restrict the functionality of our website. Section 6 contains information on the statistics and tracking services used on this website, among other matters.

5.1.1. CONSENT WITH COMPLIANZ

Our website uses Complianz consent technology to obtain your consent to storing certain cookies in your browser or using certain technologies and to document that consent in compliance with data protection law. The provider is Really Simple Plugins B.V., Netherlands, https://really-simple-ssl.com/legal/privacy-statement/ (hereinafter “Complianz”). When you enter our website, cookies beginning with “cmplz_” are stored in your browser. They record the consent granted or withdrawn by category, the banner status and the version of the Privacy Policy to which you agreed. These cookies are stored for 365 days. The data is not passed on to the provider of the consent technology.

The collected data is stored until you ask us to delete it, delete the cookies yourself or the purpose for storing the data ceases to apply. Mandatory statutory retention periods remain unaffected.

The consent technology is used to obtain and demonstrate the consents required by law for the use of cookies. The legal basis is Article 6(1), point (c) GDPR.

6. WHICH SERVICES DO WE USE?

6.1.1. GOOGLE TAG MANAGER

We use Google Tag Manager on our website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a technical management tool that enables us to integrate and control the analytics and marketing services described below. The Tag Manager itself does not create profiles, store cookies or collect personal data for its own purposes. It is used solely to trigger other services that may collect data themselves.

When the container is loaded, your IP address is transmitted to Google because this is required for technical delivery. Our consent tool blocks the container, and it is loaded only after you have given the relevant consent.

The legal basis is your consent pursuant to Article 6(1), point (a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time. The information in the Google Analytics section applies accordingly to transfers to third countries and the safeguards in place.

Further information is available in Google’s Privacy Policy:
https://policies.google.com/privacy?hl=de

6.1.2. GOOGLE ANALYTICS 4

This website uses functions of the Google Analytics web analytics service, version Google Analytics 4. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. It is integrated through Google Tag Manager as described above.

Google Analytics enables us to analyse the behaviour of website visitors. We receive various usage data, such as page views, time spent on the site, operating systems used and the user’s origin. This data is assigned to the user’s device. It is not assigned to a user ID.

Google Analytics uses technologies that enable users to be recognised for the purpose of analysing user behaviour, such as cookies or device fingerprinting. The “_ga” and “_ga_” cookies are set for two years. Information collected by Google about the use of this website is generally transferred to and stored on a Google server. In Google Analytics 4, IP addresses are truncated when collected within the European Union and are not stored permanently. Separate activation of IP anonymisation is not required; according to the provider, complete IP addresses are not stored.

This service is used on the basis of your consent pursuant to Article 6(1), point (a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time.

Transfers to third countries are based on standard contractual clauses and/or the EU-US Data Privacy Framework. The provider’s current certification status is available at https://www.dataprivacyframework.gov. Further information about Google Analytics’ handling of user data is available at:
https://support.google.com/analytics/answer/6004245?hl=de

6.1.3. LINKEDIN INSIGHT TAG

We use the LinkedIn Insight Tag on our website. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. It is integrated through Google Tag Manager. This service allows us to measure whether visitors who arrived at our website through a LinkedIn advertisement perform a specific action there (conversion measurement). It also enables us to create target groups for further advertising on LinkedIn. LinkedIn provides us only with aggregated analyses that cannot be traced back to individuals.

When you access our website, your browser connects to LinkedIn servers. Your IP address and information about your device and usage behaviour are transmitted to LinkedIn. LinkedIn sets cookies from the linkedin.com domain. If you are logged in to LinkedIn, LinkedIn may associate your visit to our website with your user account.

The service is loaded only after you consent to the “Marketing” category. The legal basis is Article 6(1), point (a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time. Transfers to third countries are based on standard contractual clauses and/or the EU-US Data Privacy Framework. Further information is available in LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy.

6.1.4. CLOUDFLARE TURNSTILE

We use Turnstile to protect our forms against automated entries and misuse. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile checks in the background whether an entry in our contact form is made by a person or an automated program. For this purpose, technical connection data from your device, in particular your IP address, browser information and input behaviour, is transmitted to and evaluated by Cloudflare. It is not analysed for advertising purposes.

The service is loaded before consent is given because otherwise it could not perform its protective function. The legal basis is our legitimate interest in the security of our website and in preventing misuse pursuant to Article 6(1), point (f) GDPR. Reading and storing information on your device is strictly necessary for your expressly requested use of the form within the meaning of Section 25(2), no. 2 TDDDG. Cookies are set as part of the service.

Data transfers to the USA are based on standard contractual clauses and/or the EU-US Data Privacy Framework. Further information is available in Cloudflare’s Privacy Policy: https://www.cloudflare.com/privacypolicy/

6.1.5. GOOGLE MAPS

This site uses the Google Maps mapping service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. This service enables us to embed maps on our website.

To use Google Maps functions, your IP address must be stored. This information is generally transmitted to and stored on a Google server in the USA. The operator of this site has no influence over this transfer. If Google Maps is enabled, Google may use Google Fonts to display fonts consistently. When Google Maps is accessed, your browser loads the required web fonts into its browser cache so that text and fonts are displayed correctly.

Google Maps is used in the interest of presenting our online offerings attractively and making the locations shown on our website easy to find. This constitutes a legitimate interest within the meaning of Article 6(1), point (f) GDPR. Where consent has been requested, processing is carried out exclusively on the basis of Article 6(1), point (a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG.

You may withdraw your consent at any time. Data transfers to the USA are based on the European Commission’s standard contractual clauses.

Details are available at:
https://privacy.google.com/businesses/gdprcontrollerterms/
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/
Further information about the handling of user data is available in Google’s Privacy Policy: https://policies.google.com/privacy?hl=de

6.1.6. EXTERNAL HOSTING

This website is hosted externally. Personal data collected on this website is stored on the server or servers of the hosting provider or providers. This may include IP addresses, contact enquiries, metadata and communication data, contractual data, contact details, names, website access data and other data generated through a website.

External hosting is used to fulfil contracts with prospective and existing customers (Article 6(1), point (b) GDPR) and in the interest of securely, quickly and efficiently providing our online offering through a professional provider (Article 6(1), point (f) GDPR). Where consent has been requested, processing is carried out exclusively on the basis of Article 6(1), point (a) GDPR and Section 25(1) TDDDG, insofar as the consent covers storing cookies or accessing information on the user’s device, such as device fingerprinting. You may withdraw your consent at any time.

Our hosting provider or providers process your data only to the extent necessary to fulfil their service obligations and follow our instructions regarding this data. We use the following hosting provider:
Trafo2 GmbH
Alfredstraße 356
D-45133 Essen
https://www.trafo2.de/

We have concluded a data processing agreement with the service provider in accordance with Article 28 GDPR.

6.1.7. SOCIAL MEDIA | REDIRECT BUTTONS

Our websites contain redirect buttons that you can click to share content from our website on social media such as Facebook (Meta), X (formerly Twitter), LinkedIn and Xing. These buttons are simple links; merely accessing our site does not transmit personal data to social media providers.

This must be distinguished from the LinkedIn Insight Tag marketing service described above, which transmits data to LinkedIn if you have consented.

If you click a redirect button, the social media provider collects personal data from you directly. We cannot exclude the possibility that social network operators may identify that you were redirected from our site, viewed our company profile on the network and may have interacted with it, and may use this information for their own advertising purposes. Please read the privacy policy of the relevant social media provider before clicking the corresponding redirect button.

We also collect data that you voluntarily provide to us via social media such as Facebook (Meta), X (formerly Twitter), Xing or LinkedIn. If you respond to emails or surveys directly on these social media pages, your data is collected both on the social media platform and on our platform.

Further information on the purpose and scope of data collection, processing and use by the relevant social media providers is available in the following privacy policies:
Facebook/Meta: https://de-de.facebook.com/about/privacy/
X, formerly Twitter: https://x.com/de/privacy
XING AG: https://privacy.xing.com/de/datenschutzerklaerung
LinkedIn: https://www.linkedin.com/legal/privacy-policy

7. WHAT DATA PROTECTION RIGHTS CAN YOU EXERCISE?

You may withdraw your consent to the storage of data and your email address and to their use for sending the newsletter at any time, for example via the “unsubscribe” link in the newsletter. At the address stated above, you may request information about the data stored concerning you. You may also request rectification or erasure of your data. You may have the right to restrict processing and the right to receive the data you have provided in a structured, commonly used and machine-readable format. You also have the right to lodge a complaint with a data protection supervisory authority.

The data protection supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de

Alternatively, you may contact the Data Protection Officer of the KGAL Group at any time.

8. WHAT RIGHT TO OBJECT DO YOU HAVE?

For further information about your rights, please see section F of this Privacy Policy.

9. HOW LONG IS YOUR DATA STORED?

The retention period for personal data is determined by the applicable statutory retention period, such as retention periods under commercial and tax law. Once that period expires, the relevant data is routinely deleted unless it is still required to perform or initiate a contract and/or we continue to have a legitimate interest in retaining it.

10. IS YOUR DATA TRANSFERRED TO A THIRD COUNTRY?

If you have consented to the use of the analytics and marketing services described above, personal data may be transferred to recipients in third countries. This applies in particular to Google Ireland Limited, LinkedIn Ireland Unlimited Company and Cloudflare, Inc., whose parent groups are based in the USA.

Such transfers are based on standard contractual clauses and/or the EU-US Data Privacy Framework.

11. PROFILING MEASURES?

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

12. DATA SECURITY

The data concerning you that is disclosed to us is processed in accordance with statutory requirements. KGAL employees treat as confidential the personal information you provide when visiting our website. All KGAL employees are required in writing to maintain data confidentiality. The Data Protection Officer and Internal Audit regularly review compliance with data protection requirements.

We have implemented the necessary technical and organisational measures to ensure a high level of protection for your personal data. KGAL’s data processing network is protected from external access by a state-of-the-art firewall system. Internal KGAL applications are accessible to authorised users only through a login procedure using an individual user ID and password. Within the applications, user rights are restricted according to business needs through authorisation systems.

C. APPLICANTS

Thank you for your interest in us and for applying or having applied for a position in our company. Below, we explain how we process your personal data in connection with your application.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA AND WHO IS THE DATA PROTECTION OFFICER?

The company advertising the position is the controller responsible for data processing. Depending on the position for which you are applying or have applied, this is:
KGAL GmbH & Co. KG
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Fax +49 89 64143-150
Email kgal(>@<)kgal.de

or one of its subsidiaries.

Further information about our company, the persons authorised to represent it and additional contact options is available in the legal notice on our website.
You can contact our Data Protection Officer at:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Email: datenschutz(>@<)kgal.de

2. WHAT DATA DO WE PROCESS ABOUT YOU?

The categories of personal data processed include, in particular, your master data, such as first name, surname, name affixes and nationality; contact details, such as your private address, telephone number and email address; and all data relating to the application process, including cover letters, certificates, questionnaires, interviews, qualifications and previous employment. If you voluntarily provide special categories of personal data in your application or during the application process, such as health data, religious affiliation or degree of disability, such data is processed only if you have consented or if another statutory authorisation permits the processing.

3. FOR WHAT PURPOSES IS YOUR DATA PROCESSED?

Your data is processed to conduct and administer the application process and to assess your suitability for the intended position. Processing your data is necessary in order to decide whether to establish a contractual relationship.

4. WHAT LEGAL BASIS APPLIES?

The legal basis for processing your personal data in this application process is Article 6(1), sentence 1, point (b) GDPR in conjunction with Section 26(1) BDSG. This permits the processing of data necessary for deciding whether to establish an employment relationship. Processing may also be based on other legislation, such as the Works Constitution Act (BetrVG), the General Equal Treatment Act (AGG), and laws governing money laundering, tax and social security. Where processing is based on consent, you have the right to withdraw that consent at any time with effect for the future.

In individual cases, we process your data to safeguard our legitimate interests or those of third parties, such as public authorities. This applies in particular to the investigation of criminal offences (legal basis: Article 6(1), sentence 1, point (f) GDPR and, for employment relationships, in conjunction with Section 26(1), sentence 2 BDSG) or to intra-group data exchange for administrative purposes. Special categories of personal data, such as health data, are processed on the basis of your consent pursuant to Article 9(2), point (a) GDPR and, for employment relationships, in conjunction with Section 26(2) BDSG, unless a statutory authorisation applies, such as Article 9(2), point (b) GDPR and, for employment relationships, in conjunction with Section 26(3) BDSG.

5. WHERE DOES YOUR DATA COME FROM?

As a rule, your personal data is collected directly from you during the application process. We may also receive data from third parties, such as recruitment agencies, to whom you have provided your data for onward transmission.

6. WHO RECEIVES YOUR DATA?

Within our company, only those persons and departments that need your personal data to decide whether to enter into a contract and to fulfil our pre-contractual, contractual and statutory obligations receive it, for example the relevant specialist department and the works council. The application process is conducted primarily by KGAL GmbH & Co. KG itself, which is why your data is also processed there.

7. WHAT DATA PROTECTION RIGHTS CAN YOU EXERCISE?

At the address stated above, you may request information about the data stored concerning you. Under certain conditions, you may also request rectification or erasure of your data. You may have the right to restrict processing and the right to receive the data you provided in a structured, commonly used and machine-readable format. You also have the right to lodge a complaint with a data protection supervisory authority.

The data protection supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de

Alternatively, you may contact the responsible company Data Protection Officer named above at any time. For further information about your rights, please see section F of this Privacy Policy.

8. WHAT RIGHT TO OBJECT DO YOU HAVE?

If we process your data to safeguard legitimate interests, you may object to this processing on grounds relating to your particular situation. We will then cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

9. HOW LONG IS YOUR DATA STORED?

If no contractual relationship is established, we delete your personal data six months after completion of the application process. This does not apply where statutory provisions prevent deletion, where continued storage is necessary for evidentiary purposes or where you have consented to longer retention.

10. IS YOUR DATA TRANSFERRED TO A THIRD COUNTRY?

Your personal data is not transferred to a third country. Third countries are countries outside the European Economic Area.

11. TO WHAT EXTENT ARE AUTOMATED INDIVIDUAL DECISIONS OR PROFILING MEASURES USED?

We do not use automated processing to make decisions. This includes profiling.

D. TENANTS

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA AND WHO IS THE DATA PROTECTION OFFICER?

General information: Your landlord is the controller responsible for data processing. The landlord is the party to the tenancy agreement concluded with you, to which we refer here. Please use the landlord’s company name and the postal address known to you. If you wish to contact one of the property management companies known to you, this is:

KGAL GmbH & Co. KG
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Fax +49 89 64143-150
Email kgal(>@<)kgal.de

or one of its subsidiaries.

You can contact our Data Protection Officer at:
Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Email: datenschutz(>@<)kgal.de

2. WHAT DATA DO WE PROCESS ABOUT YOU?

Relevant personal data includes personal details (name, address and other contact details, date, name and place of birth, occupation, marital status and nationality), identification data (such as identity document data), authentication data (such as a specimen signature), and other master and contractual data (such as information about existing contracts, payment data and the roles of the data subject, for example as a tenant). It may also include order data (such as payment instructions), data resulting from the performance of our contractual obligations (such as payment transaction data), information about your financial situation (such as salary and creditworthiness data), data relating to tenant contacts and case processing, and other data comparable with the categories listed above.

3. FOR WHAT PURPOSES IS YOUR DATA PROCESSED?

Your personal data is processed to provide rental services requested by you, to carry out your instructions and to perform all activities necessary for the operation and management of real estate. The purposes of processing include, among other things, service charge statements, maintenance and repairs, and the execution of transactions. Further details on the purposes of data processing can be found in the relevant contractual documents.

4. WHAT LEGAL BASIS APPLIES TO THE PROCESSING?

Processing is carried out to perform the tenancy agreement and is therefore based on Article 6(1), sentence 1, point (b) GDPR. Where necessary, we also process your data beyond the actual performance of the contract to safeguard our legitimate interests or those of third parties pursuant to Article 6(1), sentence 1, point (f) GDPR. This may include consulting and exchanging data with credit agencies to assess creditworthiness or default risks; establishing, exercising and defending legal claims; ensuring IT security and IT operations; preventing and investigating criminal offences; using video surveillance to collect evidence of criminal offences and thereby protect tenants and employees; exercising domiciliary rights; and ensuring building and facility security.

Where you have consented to the processing of personal data for specific purposes, the processing is lawful on the basis of your consent pursuant to Article 6(1), sentence 1, point (a) GDPR. You may withdraw consent at any time. Please note that withdrawal applies only with effect for the future.

We are also subject to various legal obligations, meaning statutory requirements pursuant to Article 6(1), sentence 1, point (c) GDPR, such as anti-money laundering and tax laws, as well as regulatory requirements. The purposes of processing include credit checks, identity and age verification, fraud and money-laundering prevention, compliance with tax control and reporting obligations, risk assessment and management, and providing information to public authorities.

5. WHERE DOES YOUR DATA COME FROM?

We process personal data that we receive from you in the course of our business relationship, for example through the tenancy agreement. To the extent necessary to provide our services, we also process personal data that we have lawfully received, and may lawfully receive in future, from partners responsible for you or from other third parties, such as SCHUFA, for example on the basis of your consent, to carry out instructions, perform contracts or on the basis of consent you have given. We also process personal data lawfully obtained from publicly accessible sources, such as land registers, commercial and association registers, the press, the internet and other media.

6. WHO RECEIVES YOUR DATA?

Within KGAL, access to your data is granted to those departments that require it to fulfil contractual and statutory obligations. Service providers, agents and processors engaged by us pursuant to Article 28 GDPR may also receive data for these purposes, provided they comply with data protection requirements. These include companies in the categories of property management, IT services, telecommunications, debt collection, advisory and consulting services, and address research.

We may disclose information about you only where permitted or required by law, where you have consented or where we are authorised to provide information. Under these conditions, recipients of personal data may include public bodies and institutions, such as tax and law-enforcement authorities, where there is a statutory or official obligation; credit institutions, financial service providers or comparable entities to which we transmit personal data in order to conduct the business relationship with you, such as guarantors and credit agencies; and other companies within the KGAL Group where necessary to provide the services.

7. WHAT DATA PROTECTION RIGHTS CAN YOU EXERCISE?

Every data subject has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR and the right to data portability under Article 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the rights of access and erasure. You also have the right to lodge a complaint with a competent data protection supervisory authority pursuant to Article 77 GDPR in conjunction with Section 19 BDSG.

You may withdraw consent to the processing of personal data at any time. This also applies to consent declarations given to us before the General Data Protection Regulation took effect, i.e. before 25 May 2018. Please note that withdrawal applies only with effect for the future. You may lodge a complaint with the Data Protection Officer of the KGAL Group named above or with a data protection supervisory authority.

The data protection supervisory authority responsible for companies based in Bavaria is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de

8. WHAT RIGHT TO OBJECT DO YOU HAVE?

9. HOW LONG IS YOUR DATA STORED?

We process and store your personal data for as long as necessary to fulfil our contractual and statutory obligations. Please note that our business relationship is a continuing obligation intended to last for years. We are also subject to various retention and documentation obligations arising, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The prescribed retention and documentation periods may extend for up to ten years after the end of the business relationship or pre-contractual legal relationship. The storage period is also determined by statutory limitation periods, which under Sections 195 et seq. of the German Civil Code (BGB), for example, are generally three years but may in certain cases be up to thirty years.

We delete your personal data as soon as it is no longer required for the purposes stated above. Personal data may, however, be retained for the period during which claims may be asserted against our company. We also store your personal data where required by law. Relevant documentation and retention obligations arise, among other things, from the German Commercial Code, the German Fiscal Code and the German Anti-Money Laundering Act. The retention periods may therefore be up to ten years.

10. IS YOUR DATA TRANSFERRED TO A THIRD COUNTRY?

Personal data is transferred to entities in countries outside the European Union or European Economic Area, known as third countries, only where this is necessary to carry out your instructions, for example a payment instruction to a third country. Otherwise, personal data is not transferred to third countries.

In connection with remote maintenance of standard IT components, it cannot be ruled out that, in rare individual cases and for troubleshooting purposes, an IT service provider in a third country, such as the USA, may obtain controlled and limited access to personal data. Where required by law, we will inform you separately of the details.

Where it is necessary to transfer personal data to service providers in third countries, we do so only if the European Commission has confirmed an adequate level of data protection or if other appropriate safeguards are in place, such as binding corporate rules or EU standard contractual clauses.

11. ARE YOU REQUIRED TO PROVIDE DATA?

Within the tenancy relationship, you need provide only the personal data required to establish, conduct and terminate the business relationship or that we are legally required to collect. Without this data, we will generally have to decline to conclude the contract or carry out the instruction, or may no longer be able to perform an existing contract and may have to terminate it.

12. TO WHAT EXTENT IS AUTOMATED INDIVIDUAL DECISION-MAKING USED?

As a rule, we do not use fully automated decision-making within the meaning of Article 22 GDPR to establish or conduct the business relationship. If we use such procedures in individual cases, we will inform you separately where required by law.

13. TO WHAT EXTENT IS YOUR DATA USED FOR PROFILING?

We do not process your data with the aim of automatically evaluating specific personal aspects.

E. INVESTORS

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA AND WHO IS THE DATA PROTECTION OFFICER?

KGAL GmbH & Co. KG
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Fax +49 89 64143-150
Email kgal(>@<)kgal.de

or one of its subsidiaries.

You can contact our Data Protection Officer at:

Data Protection Officer of the KGAL Group
Tölzer Straße 15
82031 Grünwald
Telephone +49 89 64143-0
Email: datenschutz(>@<)kgal.de

2. WHAT DATA DO WE PROCESS ABOUT YOU?

The categories of personal data processed include, in particular, your master data, such as first name, surname, name affixes and nationality; contact details, such as your private address, telephone number and email address; data relating to your investment in one of our products, including limited partnership capital, liability amount, capital calls and distributions; and data required for payment and other processing, such as bank details, tax number and competent tax office.

3. FOR WHAT PURPOSES IS YOUR DATA PROCESSED?

Data is processed to implement the investment offering.

4. WHAT LEGAL BASIS APPLIES?

The legal basis for processing your personal data is Article 6(1), sentence 1, point (b) GDPR. This permits the processing of data necessary to perform a contract. Processing may also be based on other legislation and statutory provisions, such as anti-money laundering and tax laws. Where processing is based on consent, you have the right to withdraw that consent at any time with effect for the future.

In individual cases, we process your data to safeguard our legitimate interests or those of third parties, such as public authorities. This applies in particular to the investigation of criminal offences pursuant to Article 6(1), sentence 1, point (f) GDPR and to intra-group data exchange for administrative purposes.

5. WHERE DOES YOUR DATA COME FROM?

As a rule, your personal data is collected directly from you. We may also have received data from third parties, such as intermediaries, to whom you provided your data for onward transmission.

6. WHO RECEIVES YOUR DATA?

Within our company, only those persons and departments, such as the relevant specialist department, that need your personal data to decide whether to conclude the contract and to fulfil our pre-contractual, contractual and statutory obligations receive it. Other recipients are the parties engaged to implement and administer the investment, in particular administrators, tax advisers, auditors and domestic and foreign tax authorities.

7. WHAT DATA PROTECTION RIGHTS CAN YOU EXERCISE?

The data protection supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Email: poststelle@lda.bayern.de

Alternatively, you may contact the company Data Protection Officer named above at any time. For further information about your rights, please see section F of this Privacy Policy.

8. WHAT RIGHT TO OBJECT DO YOU HAVE?

9. HOW LONG IS YOUR DATA STORED?

10. IS YOUR DATA TRANSFERRED TO A THIRD COUNTRY?

Your personal data is not transferred to a third country. Third countries are countries outside the European Economic Area.

11. ARE YOU REQUIRED TO PROVIDE DATA?

Within the investment relationship, you need provide only the personal data required to establish, conduct and terminate the investment or that we are legally required to collect. Without this data, we will generally have to decline to enter into the investment or carry out the instruction, or may no longer be able to perform an existing contract and may have to terminate it.

12. TO WHAT EXTENT ARE AUTOMATED INDIVIDUAL DECISIONS OR PROFILING MEASURES USED?

We do not use automated processing to make decisions. This includes profiling.

F. YOUR RIGHTS

Applicable data protection law grants you comprehensive rights as a data subject in relation to the controller’s processing of your personal data, including rights of access and intervention. We inform you of these rights below:

1. RIGHT OF ACCESS PURSUANT TO ARTICLE 15 GDPR

In particular, you have the right to obtain information about the personal data concerning you that we process; the purposes of processing; the categories of personal data processed; the recipients or categories of recipients to whom your data has been or will be disclosed; the envisaged storage period or the criteria used to determine that period; the existence of rights to rectification, erasure, restriction of processing, objection to processing and complaint to a supervisory authority; the source of your data where it was not collected from you by us; the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you; and the safeguards pursuant to Article 46 GDPR that apply when your data is transferred to third countries.

2. RIGHT TO RECTIFICATION PURSUANT TO ARTICLE 16 GDPR

You have the right to the rectification without undue delay of inaccurate data concerning you and/or the completion of incomplete data stored by us.

3. RIGHT TO ERASURE PURSUANT TO ARTICLE 17 GDPR

You have the right to request the erasure of your personal data where the conditions of Article 17(1) GDPR are met. However, this right does not apply in particular where processing is necessary for exercising the right of freedom of expression and information, compliance with a legal obligation, reasons of public interest, or the establishment, exercise or defence of legal claims.

4. RIGHT TO RESTRICTION OF PROCESSING PURSUANT TO ARTICLE 18 GDPR

You have the right to request restriction of the processing of your personal data while the accuracy of data you contest is being verified; where you oppose erasure of your data because the processing is unlawful and request restriction instead; where you require the data for the establishment, exercise or defence of legal claims after we no longer need it for the purposes of processing; or where you have objected on grounds relating to your particular situation and it has not yet been determined whether our legitimate grounds override yours.

5. RIGHT TO NOTIFICATION PURSUANT TO ARTICLE 19 GDPR

Where you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller must communicate that rectification, erasure or restriction to all recipients to whom the personal data concerning you was disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about those recipients.

Right to data portability pursuant to Article 20 GDPR: You have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format or, where technically feasible, to request its transmission to another controller.

6. RIGHT TO WITHDRAW CONSENT PURSUANT TO ARTICLE 7(3) GDPR

You have the right to withdraw consent previously given to the processing of data at any time with effect for the future. If consent is withdrawn, we will delete the data concerned without undue delay unless further processing can be based on a legal ground that does not require consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

7. HT TO LODGE A COMPLAINT PURSUANT TO ARTICLE 77 GDPR

If you consider that the processing of personal data concerning you infringes the GDPR, you have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

8. RIGHT TO OBJECT

Where, after balancing interests, we process your personal data on the basis of our overriding legitimate interest, you have the right at any time, on grounds relating to your particular situation, to object to that processing with effect for the future.

If you exercise your right to object, we will cease processing the data concerned. However, we may continue processing if we can demonstrate compelling legitimate grounds that override your interests, fundamental rights and freedoms, or if the processing serves to establish, exercise or defend legal claims.

Where we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing. You may exercise your objection as described above. If you exercise your right to object, we will cease processing the data concerned for direct marketing purposes.

Last updated: September 2026