Bruns Real Estate Asset Management

Privacy policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. The following information explains how we handle your personal data when you use our website. Personal data means any information that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Martin Bruns, Bruns Real Estate Asset Management, Königsallee 14, 40212 Düsseldorf, Germany, tel.: +4921113866310, email: info@bruns-ream.com. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data collection when visiting our website

2.1 If you use our website for information purposes only, without registering or otherwise providing us with information, we collect only the data that your browser transmits to the website server (known as “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • The page of our website visited
  • The date and time of access
  • The amount of data sent in bytes
  • The source or reference from which you reached the page
  • The browser used
  • The operating system used
  • The IP address used, where applicable in anonymised form

Processing takes place pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content, such as orders or enquiries sent to the controller, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock symbol in your browser's address bar.

3) Hosting & Content Delivery Network

To host our website and display its content, we use a provider that supplies its services, either itself or through selected subcontractors, exclusively on servers within the European Union.

All data collected on our website is processed on these servers, unless different data recipients are specified below for particular processing activities.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

4) Contacting us

Personal data is collected when you contact us, for example via a contact form or email. The data collected when a contact form is used is shown in the respective form. This data is stored and used exclusively to respond to your enquiry or to contact you and carry out the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Article 6(1)(f) GDPR. If your contact is aimed at entering into a contract, Article 6(1)(b) GDPR provides an additional legal basis for processing. Your data will be deleted once your enquiry has been fully processed. This is the case when the circumstances indicate that the matter concerned has been conclusively resolved and no statutory retention obligations prevent deletion.

5) Web analytics services

Matomo

This website uses a web analytics service from the following provider: InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand (“Matomo”).

To protect website visitors, Matomo uses a “config_id” to enable various analyses of website usage within a short time window of up to 24 hours. The “config_id” is a randomly assigned, time-limited hash of a limited set of the visitor's settings and attributes. The config_id, or config hash, is a string calculated for a visitor on the basis of their operating system, browser, browser plugins, IP address and browser language. Matomo does not use device fingerprinting and uses an anonymised IP address of the website visitor to create the “config_id”.

Where the information processed in this way includes personal user data, processing takes place pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes. To enable you to object to the processing of your visitor data with effect for the future, we provide a separate opt-out option on our website.

Data is transmitted to the provider only if the service is not hosted on our own servers. If we host the service ourselves, no data collected through the service is transmitted to the provider.

If the service is not hosted on our own servers, we have entered into a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

In this case, data transfers to New Zealand are covered by an adequacy decision of the European Commission, which attests to compliance with European data protection standards for international data transfers.

6) Rights of the data subject

6.1 Applicable data protection law grants you the following rights against the controller in relation to the processing of your personal data (rights of access and intervention). For the conditions governing the exercise of each right, please refer to the legal provision cited:

  • Right of access pursuant to Article 15 GDPR;
  • Right to rectification pursuant to Article 16 GDPR;
  • Right to erasure pursuant to Article 17 GDPR;
  • Right to restriction of processing pursuant to Article 18 GDPR;
  • Right to notification pursuant to Article 19 GDPR;
  • Right to data portability pursuant to Article 20 GDPR;
  • Right to withdraw consent pursuant to Article 7(3) GDPR;
  • Right to lodge a complaint pursuant to Article 77 GDPR.

6.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

7) Duration of storage of personal data

The storage period for personal data is determined by the respective legal basis, the purpose of processing and, where applicable, the relevant statutory retention period, such as retention periods under commercial and tax law.

Where personal data is processed on the basis of express consent pursuant to Article 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods apply to data processed in connection with contractual or similar obligations on the basis of Article 6(1)(b) GDPR, that data is routinely deleted after the retention periods expire, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in retaining it.

Where personal data is processed on the basis of Article 6(1)(f) GDPR, it is stored until you exercise your right to object pursuant to Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Article 6(1)(f) GDPR, it is stored until you exercise your right to object pursuant to Article 21(2) GDPR.