Source: https://www.erstegroupimmorent.com/en/data-protection
Timestamp: 2019-04-20 20:45:57+00:00

Document:
Thank you for your interest in our website and our company. Although we carefully check external links, we are not liable for the content and security of these external links.
We protect your personal information as best we can when collecting, processing and during your visit to our website. Your data is protected by law. Below you will find explanations on the nature of the information collected when you visit our website and how they are used.
As of May 25, 2018, the General Data Protection Regulation, briefly GDPR, will apply in the European Union. It contains regulations regarding the processing and the protection of your personal data. This document provides you with the essential information regarding data protection in a summarized form.
The GDPR is a regulation of the European Union. It is directly applicable in every member state of the EU, hence also in Austria. Every natural person can refer to the GDPR if his/ her data is being processed. Detailed information can be found here.
The GDPR contains regulations on processing of you personal data. This includes for example your name, phone number, your account turnover or your hobbies – all of this is protected by the GDPR. The principles stipulated by the GDPR regulate how your personal data can be stored or processed. Detailed information can be found here.
Why is there still an Austrian data protection law (DSG 2018)?
Not only has the European Union adopted the GDPR, but it has introduced a complete data protection package. A part of this package was the new data protection guideline. What differs a guideline from a regulation? A guideline has to be translated into national law in order to become effective. Furthermore, the GDPR leaves room for the member states to manage certain aspects in more detail.
Austria is covered both by the “Datenschutz-Anpassungsgesetz 2018” (DSG or DSG 2018) as well as the GDPR. If appropriate for you, we will always consider the DSG 2018 as well for you.
Why is it important to protect my data?
Data protection is a basic right. Your right of data protection is anchored in the EU-Charter of Fundamental Rights the same way as your right to freedom and right to safety. The EU-Charter of Fundamental Rights is valid between you and state institutions.
Furthermore, it is legally accepted that the private and business sector also have to ensure a balanced relationship of interest between data processor and data subject – e.g. between you and your bank. These rules can be found in the GDPR and DSG 2018.
Personal data provide a lot of information about us: our hobbies, preferences and dreams may become apparent. Evidently, this is worth protecting. However, we are only able to improve our services for you individually, if we understand your preferences. A core element of data protection is to find a common ground on how your personal data can be processed in your interest under our supervision.
A core element of data protection is that we can together find a way in which we can process your data in your interest and under your supervision. Further information can be found here.
Is the bank secrecy law not valid anyhow in Austria?
Yes, all information provided to us over the course of our business relationship is protected by the Austrian bank secrecy law – acc. to § 38 BWG. The GDPR complements this law.
Where can I learn more about GDPR and DSG 2018?
“Personal data” is all information that relates to an identifiable natural person („data subject“). An identifiable person is a natural person that can be identified directly or indirectly, by Name or identification number such as IBAN or account ID.
This information can be found in Art. 4 point 1 GDPR.
The term “processing” covers every procedure in the context of personal data that is conducted with or without automated processing. This includes for instance collecting, capturing, organizing, sorting, storing adapting or changing, reading out, requesting, using, publishing (transmitting, spreading or another form of making data available), comparing, linking, limiting or deleting.
This information can be found in Art. 4 point 2 GDPR.
What is a “data controller”?
The term “data controller” comprises every natural or legal person, authority or institution that decides upon the purpose and way of processing personal data either alone or together with other institutions. We as a bank for instance are a data controller.
This information can be found in Art. 4 point 7 GDPR.
What is a “data processor”?
The term “data processor” comprises every natural or legal persons, authority or institution that processes personal data on behalf of a data controller.
This information can be found in Art. 4 point 8 GDPR.
Master and credential data, eg Name, address, date of birth, phone number, tax status, ID card details, ID card copy etc.
Contract data, eg. beginning of rental, commitment, etc.
Please keep in mind: this is just a general list. We do not always have all of the above data. For a detailed, individual installation, you are entitled to information and can request it from us. Who you need to contact can be found here.
Where does the personal data we process come from?
Most of your personal data that we process, you have provided to us yourselves (for example, at the conclusion of the contract by handing over a copy of identity card).
In addition, we may receive data from governmental agencies or from sovereigns such as: guardianship- or criminal courts, prosecutors, court commissioners. For a detailed statement on information concerning you, you have the “right to access”.
For which purposes and on the basis of which legal basis are my personal data processed?
We are a financial institution under § 1 (2) Banking Act and Article 4 (1) (1) of Regulation (EU) 575/2013. The processing of personal data for the purpose of direct mail is not carried out by us!
As contractually agreed, we provide certain services that result from the contract, such as. Leasing rate calculations, prescriptions, etc. - this requires the processing of your data.
The processing of personal data for direct marketing may also be a legitimate interest.
Am I obliged to provide my personal data? What happens if I don’t want to do so?
For our business relationship, we need your personal data or the personal data of a representative of your company (ultimate beneficial owner, authorized signatories, etc.). If we do not know your name and your address, we are, for example, not able to pursue mail correspondence with you. If we are not able to check your identity, we are not allowed to establish a business relationship by law. So you see: In cases in which it is required for the business relationship based on a contract or a legal regulation, we have to process some personal data. If you do not consent, we may, unfortunately, possibly not be allowed to render or offer certain products or services.
Is there decision-making based on automated processing– e.g. profiling?
At the beginning or during our business relationship, we do not use automated decision-making under Article 22 GDPR. When lending, we check the credit rating using so-called credit scoring. The default risk of credit seekers is assessed using statistical comparison groups.
Information on general financial conditions, e.g. Income, assets, monthly expenses, liabilities, collateral.
If the default risk is too high, the loan application will be rejected and there may be an entry in the KSV1870 small loan certificate and an internal warning. If a loan application has been rejected, this can be seen in the small loan certificate at KSV1870 for 6 months, in accordance with the decision of the Data Protection Authorities.
To whom do you transfer my personal data?
Public bodies and institutions if we are legally obliged to do so, e.g. European Banking Supervisor, European Central Bank, Austrian Financial Market Supervision, financial authorities, etc.
Third parties if this is binding for the contract performance or due to legal regulations, e.g. of the recipient of a bank transfer and their payment service provider.
Are my personal data transferred to a third country?
Our processors can work with subcontractors in third countries, eg. in India. These sub-service providers are obliged to comply with Austrian data protection and security standards.
For a list of service providers currently working in third countries and information on the basics on which the transfer is based, please contact us.
What security measures are adhered to in the context of data processing?
Data protection and data security is important to us. We have taken all technical and organizational measures in order to protect our data processing. This specifically includes protection of your personal data. They are protected from unauthorized or illegal processing, accidental loss, accidental destruction or damage. These measure, for example, include application of modern security software and encryption methods, physical access control and precautionary measures to prevent external and internal attacks.
Practical tips on how you may support in protecting your personal data can be found here.
Cookies: Cookies are used in various locations on our website. Cookies are small text files that recognize users when they use the website again. However, no personal details, such as name or address, are stored. They cannot be identified by the information in question.
Web analytics: For an anonymous, statistical evaluation of the flow of visitors to the websites, we transfer personal data to the service provider Webtrekk GmbH. You can prevent this forwarding of your data.
Currently, no data is collected by Webtrekk. Click here to undo this. Click here to prevent your data from being recorded.
What does Right to Access mean?
Please write your request as concrete as possible - so we can process it quickly. Please note the special instructions for your right to data portability.
What does Right to Rectification mean?
It is important to us that your data is always correct and complete. If you suspect that they are incorrect or incomplete, you can request that the data be corrected or completed.
What do Right to Erasure and Right to be Forgotten mean?
You revoke the consent on which the processing is based, pursuant to Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR, and there is no other legal basis for the processing.
Example: You have agreed that your personal data may be processed for individual third-party product offerings (= sole purpose). Once you revoke this consent, your personal information must be deleted. Exceptions: other purposes or justifications for processing exist and you are, for example, also in a customer relationship with the third party.
You object to the processing, according to Article 21 (1) GDPR, and there are no legitimate reasons for the processing.
For example, you may object if, someone processes your personal information without your consent simply because he believes that he / she has a legitimate interest in it (and there is no justification otherwise). If you object and there was no legitimate interest, the personal data must be deleted. The objection was successful.
Illegally ("without reason") processed personal data must be deleted.
The deletion of personal data is subject to a legal obligation under EU law or the law of the Member States of those responsible.
This means laws or other legal regulations that require the deletion of personal data.
The personal data were collected in relation to the society for information services offered pursuant to Article 8 (1) of the GDPR.
This is a special protection rule in favor of minors using online services.
In short, that was the right to erasure. This should not be confused with the "right to be forgotten".
The "right to be forgotten" refers to publicly-made-available personal information. It states: If the person who originally published the data needs to delete this data (because of one of the reasons for deletion mentioned above), then it must additionally inform those persons who received the data as a result of the publication, that deletion is required. This rule is quite complicated. The GDPR refers, in particular, to internet search engines in this regard.
What does Right to Restriction of processing mean?
You deny the accuracy of your personal information. For the duration of time necessary for those responsible to verify the accuracy of their personal information, you may request that processing be restricted.
You do not always agree with the accuracy of the data. However, in order for the contentious personal data not to be deleted or changed immediately, further processing may be restricted for the duration of the matter. Maybe it turns out that the data was accurate.
The processing of personal data is unlawful. Instead of deleting, you "only” want to restrict the use of personal data.
The GDPR gives you the right to vote: If you do not want unauthorized processed data to be deleted right away, then you can request that it be saved but no longer used.
Persons responsible no longer need your personal data for processing. However, you need the information to assert, exercise or defend your rights.
If your personal information should be deleted, but you need it for your own defense or enforcement, it may be processed for that purpose.
You have objected to the processing under Article 21 (1) GDPR. As long as it is not certain whether the legitimate reasons of the person responsible outweigh your interests, the restriction of processing may be required.
In order to avoid disputed personal data being deleted immediately, further processing may be restricted for the duration of the matter. Maybe it turns out that the processing was justified.
What does Right to Data portability mean?
Your personal information is yours. You therefore have the right to receive this data in a structured, common and machine-readable format. This concerns data that you have provided to us and that is processed automatically on the basis of your consent or due to a contract fulfillment. You may also request that we transfer this personally identifiable information directly to another entity.
In which format do I receive this data?
We provide the data as an .XML file. Further information can be found here.
What important safety instructions should I take note of?
The protection of your personal data and your money is just as important to us as it is to you. Therefore, please consider your right to data portability as an account statement. Would you send it "just like that" to someone else?
the beneficiary is another financial company, law firm, notary, tax consultancy or business trustee or a public authority.
Our tip: Note that you can always use your transaction data in George e.g. of accounts, credit cards, financings or securities accounts and store it independently. So you always have an up-to-date overview.
What does the Right to Objection mean?
Your data may be processed if there is a legitimate interest.
What does the right to, not being solely subjected to automated individual decision making (including profiling), mean?
We do not use automated decision-making under Art. 22 DSGVO for decisions on the establishment and implementation of the business relationship, see here. The right to object to this is therefore not applicable.
How and where can I claim my rights?
What information do I have to give?
In order to prevent that your financial data falls into the wrong hands or that your data is deleted against your will, we need to authenticate your identity for each request. We kindly ask for your understanding that in case of doubt, we will request more information regarding your identity. This also serves your protection, to only give authorized persons access to your data.
How can I submit the application?
By email, only with qualified electronic signature, to, DataProtectionManagement@immorent.com. Please write your request as concretely as possible - so we can process it quickly. Please note the special instructions for your right to data portability.
How long does the processing of my request take?
We will provide you with the relevant information without delay but in any event within one month of receipt.
In case of complexity and high number of request, the deadline maybe extended by another two months if necessary.
Financial affairs are a matter of trust – unfortunately, emails are not always trustworthy. E-Mails are more like a postcard when it comes to security. Since we do not want to send your bank details on a postcard, we will send you the information by post.
What needs to be taken into account when it comes to the right to data portability?
Please remember that your financial data contains personal data of other persons: If you transfer money to relatives or acquaintances, it is also reflected in the transferred data – as well as on a bank statement.
o the beneficiary is another financial company, law firm, notary, tax consultancy or business trustee or a public authority.
Before you exercise your right to data portability: Did you know that in George you can view your transaction data anyway and save it yourself?
Does it cost me anything if I assert my rights?
No, the applications are done free of charge. Exceptions: Only if the request are manifestly unfounded or excessive, we are entitled to demand a reasonable fee. This takes into account the administrative costs of notifying, refusing or implementing the requested measure.
Are there any possibilities to complain?
For all complaints, questions and suggestions on data protection, our data protection officer is reachable. We are convinced that a common solution to almost any problem can be found.

References: § 38
 Art. 4
 Art. 4
 Art. 4
 Art. 4
 § 1
 Art. 22