Office tower at Alexanderplatz

DE

Privacy policy

This privacy notice describes the processing of personal data when you use our websites. It also explains the choices you have regarding your personal data (“your rights”) and how you can contact us.

A. General Information

I. Controller

Covivio SA, 1 18, Avenue François Mitterrand, 57000 Metz (France), is responsible for the processing of your personal data in connection with the operation of this website. If you contact us via the contact form, by telephone or by email, Covivio Alexanderplatz S.à.r.l., 5 Place de la Gare, L-1616 Luxembourg (Luxembourg) will be joint controller with us for the processing of your personal data.

If you have any questions or requests regarding data processing, please contact our data protection team at datenschutz@covivio.immo.

II. Data Protection Officer

You can contact our Data Protection Officer by email at dpo@covivio.fr or by post at Covivio S.A., Attn: Data Protection Officer, 18, Avenue François Mitterrand, 57000 Metz (France).

III. Your Rights as a Data Subject

Every data subject has the following rights:

You may object at any time, without giving reasons, to the processing of personal data for direct marketing purposes, including any analysis of customer data for advertising purposes.

In addition, data subjects have a general right to object (cf. Art. 21(1) GDPR). In this case, the objection to the processing must be substantiated. Where processing is based on consent, you may withdraw your consent at any time with effect for the future.

To exercise your data subject rights, please use the contact details set out in section A. I. above.

You also have the right to lodge a complaint with the supervisory authority competent for you.

IV. Children

Our online services are not directed at children under the age of 16.

V. Links to Third-Party Websites

Our website may contain links to third-party websites. We would like to point out that we are not the controller within the meaning of Art. 4(7) GDPR for the processing of your personal data on these websites. Please consult the privacy notices of the respective websites before disclosing any personal data.

B. Processing When You Use Our Website

Below, we would like to give you an overview of how we ensure the protection of your personal data when you access our website and which types of personal data we process, for which purposes and to what extent.

I. Each Time You Visit Our Website

1. Hosting

When you access our website, technical information is exchanged between the servers on which our website is operated and your device (computer, tablet, mobile phone). In the process, the following data is transmitted by your browser and processed by our servers:

This information is technically necessary in order to deliver the content of our websites requested by you correctly and in the correct language version, and is necessarily generated when using the internet. This, together with an appealing external presentation, also constitutes our legitimate interest pursuant to Art. 6(1)(f) GDPR.

In accordance with our IT security concept, the log file data generated is stored for a period of two weeks in order to detect and analyse any attacks on our website. The legal basis for the processing is Art. 6(1)(f) GDPR. Our legitimate interest is the protection of our information technology systems. To operate the websites, we use the hosting provider SARL Neftis, 8 rue Maréchal Lyautey, 54500 Vandœuvre-lès-Nancy, France, as our processor.

2. Contacting Us, Storage of Contact Data in a CRM System

You can contact us by email, by telephone and via our contact forms to express your interest in our properties, to request an offer or to get in touch about other matters.

In order to handle your enquiry sent to us by email or via the contact form, we process, in addition to the content of your enquiry, your name, email addresses, where applicable the name of your company and your position, and where applicable any other information that is strictly necessary to prepare an offer or to send you further information. The processing of your data in connection with contacting us by email and via the contact form is based on our legitimate interest in providing good customer service pursuant to Art. 6(1)(f) GDPR or, insofar as the contact relates to the performance of a contract or to steps taken prior to entering into a contract, on Art. 6(1)(b) GDPR.

When you use our contact form, we also process data about your location (country and city based on your IP address) and data about the browser and device used. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest: maintaining IT security).

Your enquiry and your contact details may be stored in a customer relationship management system (“CRM system”) if a business relationship exists or if, based on previous communication, a business relationship can be expected to be initiated. To manage enquiries and contact details, we use a system provided by our processor Salesforce Inc., 415 Mission St FL 3, San Francisco, CA 94105, USA (https://www.salesforce.com/company/privacy/), with which we have concluded standard contractual clauses (Commission Implementing Decision (EU) 2021/914). Owing to Salesforce’s certification under the EU-US Data Privacy Framework, an EU adequacy decision applies to the transfer. The legal basis for the processing is Art. 6(1)(f) GDPR, based on our legitimate economic interest in being able to manage the contact details of customers and prospective customers systematically and efficiently, unless we have obtained your consent. We initially retain the personal data processed when handling enquiries for evidentiary purposes for a period of one year from the end of the calendar year in which the enquiry was received. We then review whether further storage is necessary. If there is no such necessity and no further statutory retention obligations apply, the data will be erased.

Enquiries may be transmitted to Cushman & Wakefield (C & W (U.K.) LLP, 125 Old Broad St, London EC2N 1AR) on the basis of our legitimate interests (economic interest in marketing the property), Art. 6(1)(f) GDPR. An adequacy decision of the European Commission exists for the transfer to the United Kingdom.

In addition, your enquiry may be transmitted to other companies of the Covivio Group insofar as this is necessary for efficient handling, Art. 6(1)(f) GDPR (economic interest in the efficient handling of enquiries and in marketing the property).

3. FriendlyCaptcha

To protect our online forms against misuse, spam and automated access (so-called bots), we use the “Friendly Captcha” service. The processor is Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee (Germany).

Friendly Captcha checks in the background whether entries on our website are made by a human or by an automated system. To this end, the service asks the user’s device to solve a cryptographic puzzle in the background (proof-of-work method).

As part of this process, the following data, among others, is processed:

The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest: protecting our website against cyberattacks and spam, and providing our forms without errors). The IP addresses collected are anonymised by one-way encryption immediately after collection. If any further personal data is collected, it will be erased after 30 days at the latest.

C. Use of Cookies and Similar Technologies

I. General Information

Our website uses so-called cookies and similar technologies. Cookies are small text files that your browser stores on your device. The content of these files can be read by our servers or by the servers of our partners, in particular in order to link your device to further information. We use both temporary cookies, which are automatically deleted when you close your browser (“session cookies”), and persistent cookies. Similar technologies include, in particular, your browser’s local storage (local storage, session storage) as well as tracking pixels and scripts (tags) that transmit information to a provider when a page is accessed. The following statements on cookies apply accordingly to these technologies.

A distinction must be made between strictly necessary cookies and cookies used for further purposes (statistics, marketing). We only use cookies for further purposes with your consent. In our privacy settings, which you can access at any time via the cookie button at the bottom left of every page, you decide to what extent you wish to allow cookies to be set.

In addition, you can specify in your browser settings whether you wish to accept all cookies, to be notified when cookies are set, or to reject all cookies. If you reject all cookies, you may not be able to use our services in full.

An overview of all cookies used, including their name, provider, purpose, category and retention period, is available in our privacy settings. This overview is generated automatically by our consent management platform and is updated continuously. The following sections describe the services used; please refer to this overview for the details of the individual cookies.

The storage of information on your device and access to such information are governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the subsequent processing of personal data is governed by the GDPR. We state the relevant legal basis for each service.

Some of the providers named below or their parent companies are based in the USA or process data there. For companies certified under the EU-US Data Privacy Framework, the European Commission has determined that an adequate level of data protection exists (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, Art. 45 GDPR). You can check the current certification status at https://www.dataprivacyframework.gov/list.

II. Strictly Necessary Cookies

We use cookies that are strictly necessary for the use of our website. These include session cookies, which recognise your device while you visit our website during a single session. These session cookies contribute to the secure use of our services and are deleted when you close your browser.

The legal basis for storing and reading these cookies is Section 25(2) no. 2 TDDDG; your consent is not required for this. Insofar as personal data is processed in this context, this is based on our legitimate interest in providing our website securely and in a functional manner, Art. 6(1)(f) GDPR.

III. Use of Cookies Based on Your Consent, Consent Management (Privacy Settings)

We use a consent management platform (consent banner) to obtain, record and manage consent and to receive withdrawals of consent. When you give, change or withdraw your consent, we store your choice in cookies on your device. This allows us to take your decision into account on subsequent page views without asking you again.

To demonstrate your consent (Art. 7(1) GDPR), we additionally record in our website’s database the user ID stored in your browser, your IP address in truncated form, the time of consent, the consent categories selected, the region from which consent was given, and the version of the cookie policy valid at the time of consent. We store the log data for up to five years.

The legal basis for storing and reading your choice on your device is Section 25(2) no. 2 TDDDG. The processing of your choice in order to take it into account on subsequent page views is based on our legitimate interest in implementing your decision without asking you again, Art. 6(1)(f) GDPR. The logging is carried out to comply with our legal obligation to demonstrate consent, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

You can withdraw your consent or change your choice at any time with effect for the future by opening the privacy settings via the cookie button at the bottom left of every page. The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

IV. Management of Various Tools via Google Tag Manager

Google Tag Manager is an organisational tool of our processor Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), which we use to integrate and manage the analysis and tracking tools described below on our website via a central interface. Tags are small code elements that cause your browser to load these tools. The data is collected by the integrated tools themselves; this is described for each tool. Tag Manager itself does not analyse your usage behaviour.

Google Tag Manager is only loaded after you have given your consent in our privacy settings. When it is loaded, your IP address is transmitted to Google for technical reasons so that the scripts can be delivered. According to Google, these server logs are deleted within 14 days. In addition, Google only collects aggregated data on the firing of tags, which contains neither IP addresses nor personal identifiers. It cannot be ruled out that data is transferred to the parent company Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework.

The use of Google Tag Manager is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future in our privacy settings.

Further information is available at https://business.safety.google/privacy/ and https://business.safety.google/adsprocessorterms/.

V. Use of Cookies to Record Usage Behaviour (Tracking, Statistics)

The use of tracking cookies enables us to recognise users when they access our website again and to assign usage activities to an internally allocated identifier (pseudonym). This allows us to record repeated visits to our website and to analyse them in context. This serves to determine which content of our website is of most interest to you. To this end, we process your data specifically

1. Google Analytics 4

On this website, we use the web analytics service Google Analytics 4 of our processor Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to evaluate your use of the website and to compile reports on website activity. This helps us to better understand how visitors use our website and to make it even more intuitive. On our behalf, Google processes information about your visits to our website under a pseudonymous user ID that is assigned to your device via a cookie. Further details on the cookies used can be found in our privacy settings.

The usage information includes page views, time spent on the site and clicks, which are supplemented by approximate location data (country, region, city) and technical information about the device, operating system and browser used. Google derives the location data from your IP address. According to Google, for users from the EU this takes place exclusively on servers in the EU; the IP address is then discarded before the data is forwarded to the analytics servers. Google Analytics does not log or store your IP address. Data stored on the basis of the user ID is automatically erased after two months.

The remaining data collected may in part also be stored and processed by Google LLC in the USA. The transfer to the USA is based on the EU-US Data Privacy Framework, under which Google LLC is certified, Art. 45 GDPR.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future in our privacy settings.

Opt-out browser add-on: https://tools.google.com/dlpage/gaoptout?hl=en

Privacy notice of Google: https://policies.google.com/privacy

2. Positive User

On our website, we use the services of Positive User (formerly User.com), a platform of our processor Positive Groupe France, 3 avenue Antoine Pinay, ZA des 4 vents, 59510 Hem, France. Positive User uses cookies, tracking pixels and similar technologies to analyse visitor behaviour on our website (pages visited, number of visits, navigation patterns, referring websites, origin). On this basis, we optimise the user experience on our website (browser notifications, browser pop-ups, customisation of the website) and our marketing campaigns.

The following data, among others, is processed:

If you have consented to the use of Positive User and have sent us a message via the contact form, the aforementioned information about your use of our website may be linked to you and stored in our customer relationship management system (CRM). This may enable us to address you in a targeted and personalised manner. You will only receive advertising by email if you have given separate consent to this or if this is permitted by law.

The processing is based on your consent, which you may withdraw at any time, pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The data is stored until you withdraw your consent or the purpose of storage no longer applies. Further details on the cookies used can be found in our privacy settings.

According to the provider, the data is hosted in Europe. Information on the sub-processors used by Positive User and on any transfer to a third country, including appropriate safeguards and the existence or absence of adequacy decisions, is available at https://assets.positivegroup-cdn.com/legal/user/DE_Subprocessors.pdf. Further information on data processing by the provider can be found in the privacy notice of Positive User at https://user.com/de/legal/.

VI. Use of Cookies for Advertising Purposes

We use cookies for marketing purposes, for example to tailor advertising to the interests of a website visitor. They are also used to limit the frequency with which an advertisement is displayed and to measure the effectiveness of an advertisement. For this purpose, the pages and content of our website that are accessed are recorded. This enables us to collect information on usage habits in order to display interest-based advertising. The cookies stored for this purpose are generally set directly by the respective advertising partner. They enable our retargeting partners to recognise you under a pseudonym and to show you advertising that is likely to be of interest to you. The information collected is transmitted to the respective advertising partner.

We use the data collected for statistical and advertising purposes, specifically

Unless otherwise stated, the processing described in this section is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future in our privacy settings.

1. Microsoft Advertising (Bing Ads)

On our website, we use the online advertising service Microsoft Advertising of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA; “Microsoft”).

With the help of so-called Universal Event Tracking (UET), a cookie or a comparable identifier is stored on your device if you have consented to this. Microsoft uses it to collect pseudonymous information about your use of our website. This includes, among other things:

Microsoft uses this data to provide us with aggregated reports and statistics on the success of our advertising campaigns. In addition, the tool enables so-called remarketing, i.e. addressing visitors to our website again with personalised advertising on Microsoft platforms or in partner networks. Microsoft also processes the data collected for its own purposes, for example to improve its services, and acts as an independent controller in this respect.

Microsoft Advertising is used for online marketing purposes, to measure the success of our advertising campaigns (conversion tracking) and for the targeted delivery of personalised advertising. The legal basis for storing cookies or accessing information on your device and for the subsequent processing of your personal data is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Microsoft does not specify a fixed retention period for UET data. According to its privacy notice, Microsoft retains personal data for as long as necessary to provide its services and for the purposes described therein. Further details on the cookies used can be found in our privacy settings.

The data collected may be transferred to the USA by Microsoft. Microsoft Corporation is certified under the EU-US Data Privacy Framework.

You can withdraw your consent at any time with effect for the future in our privacy settings. In addition, you can deactivate interest-based advertising via Microsoft’s advertising settings. Further information on data protection at Microsoft can be found in Microsoft’s privacy notice.

2. Meta Pixel (formerly Facebook Pixel)

On our website, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (parent company: Meta Platforms, Inc., USA; “Meta”).

When you access our website, the Meta Pixel executes JavaScript code that establishes a direct connection to Meta’s servers. If you have given your consent, the tool collects, among other things, the following data:

The Meta Pixel is used for online marketing purposes, to measure the success of our advertising campaigns and to optimise the delivery of advertisements on Meta’s platforms.

Meta may mark your device with a cookie and a unique identifier or read a cookie that already exists. If you are logged in to Facebook or Instagram, this data can be used to display targeted advertising for us on these platforms. We can also use this data to assess the success of our advertisements on Facebook and Instagram.

The legal basis for access to your device (cookies/local storage) and for the processing of your personal data is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. According to the Meta Business Tools Terms, Meta retains the event data collected via the pixel for a maximum of two years. Further details on the cookies used can be found in our privacy settings.

The data collected may be transferred to the USA by Meta. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

We and Meta Platforms Ireland Limited are joint controllers for the collection and transmission of the above data. For this reason, we have concluded a joint controller arrangement with Meta pursuant to Art. 26 GDPR, which sets out the respective responsibilities for compliance with the obligations under the GDPR. You can access it at https://www.facebook.com/legal/controller_addendum. Meta is the sole controller for the subsequent processing of the transmitted data. Meta has been designated as the point of contact for data subject requests relating to the data collected via the Meta Pixel. As we have no access to the data collected about you via the Meta Pixel, only Meta has direct access to the necessary information and can take any necessary measures and provide information directly. We therefore ask you to contact Meta’s data protection officer directly regarding your data subject rights: https://www.facebook.com/help/contact/540977946302970. You may nevertheless also exercise your rights against us (Art. 26(3) GDPR).

You can withdraw your consent at any time with effect for the future in our privacy settings. Further settings and information:

3. LinkedIn Insight Tag

We use the LinkedIn Insight Tag, which is provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). The LinkedIn Insight Tag is used for marketing, retargeting and reach measurement purposes.

The following data may be transmitted to LinkedIn in this process: HTTP header information (such as the IP address, information about the browser used, language settings, time), a unique cookie ID and information on events on the page (such as page views or buttons clicked).

Through this integration, LinkedIn collects data about visitors to our website. If you are registered with and logged in to LinkedIn, we can evaluate, among other things, key professional data of visitors (e.g. career level, company size, industry, location and job title) in aggregated form that does not allow any conclusions to be drawn about individual persons. This helps us to design our website and advertising campaigns in a more targeted manner.

In addition, the tool records whether you perform certain actions on our website after clicking on a LinkedIn advertisement (conversion measurement, including across devices) and enables us to show you relevant advertising on LinkedIn (retargeting). The data collected includes, among other things, the URL, the referrer URL, the IP address, device and browser characteristics and timestamps.

The data is encrypted by LinkedIn. The IP addresses are truncated, and direct identifiers of LinkedIn members are removed within seven days in order to pseudonymise the data. The remaining pseudonymised data is erased within 180 days. Further details on the cookies used can be found in our privacy settings.

The data collected may be transferred by LinkedIn to LinkedIn Corporation in the USA. LinkedIn Corporation is certified under the EU-US Data Privacy Framework.

The legal basis for this processing is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future in our privacy settings. As a LinkedIn member, you can also deactivate data collection in your account settings under “Settings & Privacy”. If you do not have a LinkedIn account, you can deactivate retargeting here.

We and LinkedIn Ireland Unlimited Company are joint controllers for the collection and transmission of the above data. For this reason, we have concluded a joint controller arrangement with LinkedIn pursuant to Art. 26 GDPR, which sets out the respective responsibilities for compliance with the obligations under the GDPR. LinkedIn is the sole controller for the subsequent processing of the transmitted data. As we have no access to the data collected about you via the LinkedIn Insight Tag, only LinkedIn has direct access to the necessary information and can take any necessary measures and provide information directly. We therefore ask you to address your data subject rights regarding processing via the Insight Tag directly to LinkedIn. You may nevertheless also exercise your rights against us (Art. 26(3) GDPR). Further information can be found in LinkedIn’s privacy notice.

4. Google Ads with Conversion Tracking

We use the Google Ads service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Ads is used to process your personal data for the purposes of targeted online advertising, conversion measurement (success and effectiveness of online advertising measures), tracking and, based on this, the creation of target groups for further advertising measures. This enables us to have online advertising within Google’s advertising network displayed predominantly to those users who are presumed to be interested in the advertisements. For example, after you have visited our website, you may be shown targeted advertising for our products and services.

For the purposes of conversion and success measurement, Google provides us with information for evaluating performance parameters such as ad impressions, clicks and conversions. This allows us to evaluate which buttons on our website were clicked and how often, and which products were viewed particularly frequently, and to determine, in relation to the data of the advertising campaigns, how successful the individual advertising measures are. For these purposes, user profiles are created to which you can be assigned by means of a cookie stored on your device or comparable methods. The information provided to us by Google is pseudonymised in such a way that it generally does not allow us to attribute it to natural persons. We only receive statistical evaluations from Google, on the basis of which we can identify which of the advertising measures used are particularly effective; we do not receive any further data from the use of the advertising material. Attribution may be possible if a so-called conversion occurs, i.e. if you contact us after clicking on one of our advertisements.

If you are registered with a Google service, Google may associate the visit with your account. Please check the privacy settings in your Google account in this regard. In user profiles, Google generally stores the following analysis values:

Google also processes the data within the scope of Google Ads for its own purposes and acts as an independent controller in this respect. According to Google, the IP address in server logs is anonymised after nine months by removing part of the address; after 18 months, cookie and advertising ID information is also removed and profile data is erased or anonymised (https://business.safety.google/adsretention/). Further details on the cookies used can be found in our privacy settings.

Insofar as Google processes personal data at Google LLC in the USA, this is done on the basis of the EU-US Data Privacy Framework, under which Google LLC is certified, Art. 45 GDPR.

The legal basis for the processing and for storing and reading cookies is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future in our privacy settings. If you do not wish to receive interest-based advertising, you can also deactivate personalised advertising from Google at https://myadcenter.google.com/. Cross-provider settings for interest-based advertising are available at https://www.youronlinechoices.eu/. Further information can be found in Google’s privacy notice at https://policies.google.com/privacy.