Privacy Policy

We are pleased that you are visiting our website. Data protection and data security when using our website are important to us. With this data protection notice, we would like to inform you about the extent to which personal data is processed when you use our website and the purposes for which this is done. We also inform you about the rights you have to protect your data.

1. Name and address of the controller

We are the controller responsible for the processing of your personal data within the meaning of Art. 4 No. 7 GDPR:

Engel & Völkers Capital AG
Große Elbstraße 59
22767 Hamburg
Germany
Phone: +49 40 743 25 08 0
E-mail: info@evc-ag.de
Register court: Hamburg Local Court
Register number: HRB 109595

2. Data processing when visiting our website

2.1. General Information

2.1.1. Data security

We use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorised access by third parties (e.g. TSL encryption for our website), taking into account the state of the art, the implementation costs and the nature, scope, context and purpose of the processing as well as the existing risks of a data breach (including its probability and effects) for the data subject. Our security measures are continuously improved in line with technological developments.

We will be happy to provide you with more detailed information on request. For more information, please contact us under the contact details under digit 1 above.

2.1.2. Cooperation with processors

As with any large company, we also use external domestic and foreign service providers to process our business transactions (e.g. for IT, logistics, telecommunications, sales and marketing). These service providers only act in accordance with our instructions and are contractually obliged to comply with data protection regulations within the meaning of Art. 28 GDPR.

If your personal data is passed on by us to our subsidiaries or is passed on to us by our subsidiaries (e.g. for advertising purposes), this is done on the basis of existing order processing relationships.

2.1.3. Requirements for the transfer of personal data to third countries

As part of our business relationships, your personal data may be passed on or disclosed to third-party companies. These may also be located outside the European Economic Area (EEA), i.e. in third countries. Such processing takes place exclusively for the fulfilment of contractual and business obligations and to maintain your business relationship with us. We will inform you about the respective details of the transfer at the relevant points below.

The European Commission certifies that some third countries have a level of data protection comparable to the EEA standard by means of so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). In other third countries to which personal data may be transferred, however, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible via binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data pursuant to Art. 46 (1), (2) lit. c GDPR (the standard contractual clauses are available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0915&locale-en), certificates or recognised codes of conduct. Please contact the organisations listed at digit 1 if you would like more information on this.

2.1.4. No automated decision-making (including profiling)

We do not intend to use personal data collected from you for automated decision-making (including profiling).

2.1.5. No obligation to provide personal data

We do not make the conclusion of contracts with us dependent on you providing us with personal data beforehand. As a customer, you are under no legal or contractual obligation to provide us with your personal data; however, we may only be able to provide certain services to a limited extent or not at all if you do not provide the necessary data. If this should exceptionally be the case within the scope of the products and services offered by us presented below, you will be informed of this separately.

2.1.6. Legal obligation to transfer certain data

We may be subject to a special legal or statutory obligation to provide the lawfully processed personal data to third parties, in particular public authorities (Art. 6 para. 1 sentence 1 lit. c GDPR).

2.2. What personal data is processed?

When you use our website, the following categories of personal data are collected, stored and processed by us:

“Log data”: When you visit our websites, a so-called log data record (so-called server log files) is stored temporarily and anonymised on our web server. This consists of:

• Page from which the page was requested (so-called referrer URL)

• Device used

• Name and URL of the requested page
• Date and time of the call
• Description of the type, language and version of the web browser used
• IP address of the requesting computer, which is shortened so that a personal reference can no longer be established
• transferred data volume
• Operating system

• Browser type and version
• Meta and communication data

• Message as to whether the call was successful (access status/Http status code)
• GMT time zone difference

“Contact form data”: When contact forms are used, the data transmitted through them is processed (e.g. surname and first name, company, email address and the time of transmission).

2.3. Purpose and legal basis of data processing

We process the aforementioned personal data in accordance with the provisions of the GDPR, the other relevant data protection regulations and only to the extent necessary. Insofar as the processing of personal data is based on Art. 6 para. 1 sentence 1 lit. f GDPR, the purposes mentioned also represent our legitimate interests.

The processing of log data serves statistical purposes and to improve the quality of our website, in particular the stability and security of the connection (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR).

The processing of contact form data is carried out to process customer enquiries (legal basis is Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR).

If the processing of the data requires the storage of information in your terminal equipment or access to information that is already stored in the terminal equipment, Section 25 (1), (2) TDDDG is the legal basis for this.

2.4. Duration of data processing

Your data will only be processed for as long as is necessary to fulfil the above-mentioned processing purposes; the legal bases specified in the context of the processing purposes apply accordingly. With regard to the use and storage duration of cookies, please refer to para. 2.5.1 and 2.5.2.

Third parties engaged by us will store your data on their system for as long as is necessary in connection with the provision of the services for us in accordance with the respective order.

You can find more details on the storage period under point. 2.5.1 and 2.5.2.

2.5. Use of cookies, plug-ins and other services on our website

2.5.1. Cookies

We use cookies on our websites. Cookies are small text files that are assigned to the browser you are using and stored on your hard drive by means of a characteristic character string and through which certain information flows to the location that sets the cookie. Cookies cannot execute programmes or transfer viruses to your computer and therefore cannot cause any damage. They serve to make the website more user-friendly and effective overall, i.e. more pleasant for you.

Cookies can contain data that makes it possible to recognise the device used. In some cases, however, cookies only contain information on certain settings that are not personally identifiable. However, cookies cannot directly identify a user.

A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored beyond the individual session. In terms of their function, a distinction is made between cookies:

• Technical cookies: These are strictly necessary to move around the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes or store which websites you have visited;
• Performance cookies: These collect information about how you use our website, which pages you visit and, for example, whether errors occur when using the website; they do not collect any information that could identify you – all information collected is anonymous and is only used to improve our website and to find out what interests our users;
• Advertising cookies, targeting cookies: These are used to offer the website user customised advertising on the website or offers from third parties and to measure the effectiveness of these offers; advertising and targeting cookies are stored for a maximum of 13 months;
• Sharing cookies: These are used to improve the interactivity of our website with other services (e.g. social networks); sharing cookies are stored for a maximum of 13 months.

The legal basis for cookies that are absolutely necessary in order to provide you with the expressly requested service is § 25 para. 2 no. 2 TDDDG. Any use of cookies that is not absolutely technically necessary for this purpose constitutes data processing that is only authorised with your express and active consent in accordance with Section 25 (1) TDDDG in conjunction with Art. 6 (1) sentence 1 lit. a GDPR. Art. 6 para. 1 sentence 1 lit. a GDPR is permitted. This applies in particular to the use of performance, advertising, targeting or sharing cookies. In addition, we only pass on your personal data processed by cookies to third parties if you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

2.5.2. Cookie Policy

Our website only uses technical cookies:

We use the “Real Cookie Banner” consent tool to manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents. Details on how “Real Cookie Banner” works can be found at <a href=”https://devowl.io/de/rcb/datenverarbeitung/” rel=”noreferrer” target=”_blank”>https://devowl.io/de/rcb/datenverarbeitung/</a>.

The legal basis for the processing of personal data in this context is Art. 6 para. 1 lit. c GDPR and Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.

Polylang uses a cookie to remember the language chosen by the user when they visit the website again. This cookie is also used to retain the language information if it is not available by other means. Examples are Ajax requests or the login page.

2.6. Social media plug-ins

We currently use the following social media plug-ins on our website: LinkedIn.

The integration of social media plug-ins into this site and our social media pages on the LinkedIn platform serve the purpose of direct and active communication with our customers and interested parties. We provide information there about our products, news and promotions.

We use the so-called two-click solution. This means that when you visit our site, no personal data is initially passed on to the providers of the plug-ins. You can recognise the provider of the plug-in by the marking on the box above its initial letter or the logo. Only if you click on the marked field and thereby activate it will the plug-in provider receive the information that you have accessed the corresponding website of our online offering. In addition, the data described under para. of this data protection notice are transmitted.

Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the data protection information provided by this provider below. There you will also find further information on your rights in this regard and setting options to protect your privacy:

LinkedIn Ireland Unlimited Company

Wilton Place, Dublin 2, Ireland. You can obtain information from the third-party provider on data protection at https://de.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy

2.7. Matomo

We use the web analysis service Matomo on our websites to analyse and check the use of our websites. We can use the statistics obtained to improve our offering and make it more interesting for you as a user.

We operate Matomo in a version that does not require cookies. This means that no Matomo cookies are stored on your computer for the purpose of web analysis. To analyse website usage, your IP address and information such as timestamps, websites visited and your language settings are recorded. We store the information collected in this way on our server.

This website uses Matomo with the “AnonymiseIP” extension. This means that IP addresses are further processed in abbreviated form and cannot be directly linked to individuals. The IP address transmitted by your browser using Matomo is not merged with other data collected by us. The legal basis for the use of Matomo is Art. 6 para. 1 sentence 1 lit. f GDPR.

You can prevent the use of Matomo by removing the following tick to activate the opt-out plug-in: [Matomo iFrame]. In this case, an opt-out cookie is stored in your browser that prevents Matomo from saving usage data. If you delete your cookies, the Matomo opt-out cookie will also be deleted. The opt-out must be reactivated when you visit our site again.

The Matomo programme is an open source project. Information from the third-party provider on data protection can be found at https://matomo.org/privacy-policy/.

3. Applications

In the event that you apply to us as an employee, trainee, intern or for another contractual relationship at the e-mail address career@evc-ag.de, we would like to provide you with the following information in addition to the general information. This information applies in particular, but not exclusively, to application processes.

3.1. Decision on the establishment of an employment relationship, training relationship, internship relationship or other contractual relationship

3.1.2. Purposes of data processing

Your personal data will be collected and processed by us for the purpose of deciding on the establishment of a contractual relationship for which you are applying (employment relationship, training relationship, internship relationship or other contractual relationship).

3.1.3. Legal basis

The legal basis for the processing is the GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG). If the contractual relationship for which you are applying is not an employment relationship within the meaning of Section 26 (8) BDSG (i.e. in particular not an employment relationship or employment for vocational training), the legal basis for the processing of your personal data is Art. 6 (1) (b) GDPR. Personal data may also be processed on the basis of other statutory provisions, in particular labour law, vocational training law and social law in their respective versions. Insofar as the processing of personal data is necessary to fulfil a legal obligation to which the controller is subject, it is based on Art. 6 para. 1 lit. c GDPR. If you declare your consent to with regard to the processing of your personal data, the legal basis for data processing is Art. 6 para. 1 lit. a GDPR.

3.1.4. Criteria for the storage period

Personal data that is processed for the purpose of deciding on the establishment of a contractual relationship is generally deleted when the processing is no longer necessary for the decision on the establishment of a contractual relationship. In this respect, the duration of storage depends on the duration of the decision-making process.

If you have sent us an unsolicited application – i.e. an application that does not relate to a specific position advertised by us – we will also process your personal data in order to decide on the establishment of a contractual relationship. The above statements apply accordingly, whereby we will generally delete your data if, in our opinion, it is not foreseeable that your personal data could be used to decide on the establishment of a contractual relationship.

If the processing of your personal data is based on consent, the storage period resulting from the declaration of consent and the possible exercise of your right of revocation are generally the decisive criteria for the storage period, whereby the revocation does not affect the processing on other legal bases.

3.2. Any processing for the assertion, exercise or defence of legal claims in connection with applications

3.2.2. Purposes of data processing

Under certain circumstances, your personal data may be used for the establishment, exercise or defence of legal claims if you or the controller to whom you have submitted the application has or is asserting legal claims.

3.2.3. Legal basis, legitimate interests

The legal basis in these cases is Art. 6 para. 1 sentence 1 lit. f GDPR. According to Art. 6 para. 1 sentence 1 lit. f GDPR, the processing of personal data is lawful if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by your interests and rights which require the exclusion of processing for the purposes of the legitimate interests pursued by the controller or by a third party. The legitimate interests of the controller or third party then lie in the assertion, exercise or defence of legal claims.

3.2.4. Criteria for the storage period

In individual cases, this may result in a storage period that extends beyond the decision on the establishment of a contractual relationship. This would be the case, for example, if there are indications that you will assert claims against the controller. The data will then be stored for as long as the processing of the data is necessary for the establishment, exercise or defence of legal claims. The criteria for the storage period may include the periods under the General Equal Treatment Act and the Labour Court Act (Section 15 (4) sentence 1 AGG; Section 61b ArbGG) as well as limitation periods or statutory retention periods.

Data may also be stored if this is provided for or prescribed by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject.

3.3. Legal or contractual obligations to provide personal data in relation to job applications

You are not obliged to provide us with personal data in order to carry out the application process. However, we cannot carry out the application process without the information required to assess your suitability, to check the requirements for lawful employment and your availability and to contact you.

4. Your rights as a data subject

You can exercise your rights as a data subject with regard to your processed personal data by contacting us using the contact details provided at the beginning of this policy under point. 1 above at any time. As the data subject, you have the right to

• to request information about your data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the purposes of processing, the category of data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of appeal, the origin of your data if it was not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on its details;
• in accordance with Art. 16 GDPR, to immediately request the correction of incorrect data or the completion of your data stored by us;
• in accordance with Art. 17 GDPR, to demand the erasure of your data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• in accordance with Art. 18 GDPR, to demand the restriction of the processing of your data if the accuracy of the data is disputed by you or the processing is unlawful;
• in accordance with Art. 20 GDPR, to receive your data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller (“data portability”);
• pursuant to Art. 21 GDPR to object to the processing if the processing is based on Art. 6 para. 1 sentence 1 lit. e or lit. f GDPR. This is particularly the case if the processing is not necessary for the fulfilment of a contract with you. If it is not an objection to direct advertising, we ask you to explain the reasons why we should not process your data as we have done when exercising such an objection. In the event of your justified objection, we will examine the situation and either discontinue or adapt the data processing or point out to you our compelling reasons worthy of protection on the basis of which we will continue the processing;
• in accordance with Art. 7 (3) GDPR, to withdraw your consent once given to us at any time (including before the GDPR came into force, i.e. before 25 May 2018) – i.e. your voluntary, informed and unequivocal expression of your consent to the processing of the personal data concerned for one or more specific purposes by means of a declaration or other unambiguous confirmatory act – if you have given such consent. As a result, we may no longer continue the data processing that was based on this consent in the future, and
• in accordance with Art. 77 GDPR, to complain to a data protection supervisory authority about the processing of your personal data in our company.

5. Changes to the data protection information

As part of the ongoing development of data protection law and technological or organisational changes, our data protection information is regularly reviewed to determine whether it needs to be amended or supplemented. You will be informed of any changes, in particular on our German website at [www.evc-ag.de/datenschutz].

Status: August 2024