We take data protection very seriously, which is why we have put together the following overview to provide you with information about how we process your personal data and about your rights under data protection law.
The controller responsible for data processing is the Institute for Federal Real Estate
Bundesanstalt für Immobilienaufgaben
Tel.: +49 (0)228 37787-0
You can contact our Data Protection Officer at
Bundesanstalt für Immobilienaufgaben
We process your personal data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the freedom of movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR) and the Federal Data Protection Act of 30 June 2017.
Each data subject has the right to information about how we use their data ("right of access", Article 15 of the GDPR), the right to ask that we correct any data they have provided to us ("right to rectification", Article 16 of the GDPR), the right to ask us to delete their data ("right to erasure", Article 17 of the GDPR), the right to ask us to limit the processing of their data ("right to restriction of processing", Article 18 of the GDPR), the right to object (Article 21 of the GDPR) and the right to receive the data concerning them and to transfer it elsewhere ("right to data portability", Article 20 of the GDPR). The restrictions set out in sections 34 and 35 of the Federal Data Protection Act apply to the right of access and the right to erasure.
You may withdraw your consent to the processing of your personal data at any time by contacting the agency to which you gave consent. The same applies in regard to withdrawing consent given before the date on which the GDPR came into effect, that is 25 May 2018. Please note that withdrawing consent will only be effective for the future. Any data processing done before consent was withdrawn will not be affected.
Should you wish to exercise any of the above data protection rights, please contact the controller responsible for data processing (for details see above).
If you have any questions whatsoever regarding the processing of your personal data or exercising your rights under the GDPR, please contact the Institute for Federal Real Estateʼs Data Protection Officer. You can either write to her at the Institute for Federal Real Estate, Bonn Office, Ellerstraße 56, D-53119 Bonn, or contact her by email: Datenschutz@bundesimmobilien.de.
If you wish to do so, you can also lodge a complaint with the data protection supervisory authority (Article 77 of the GDPR in conjunction with section 19 of the Federal Data Protection Act). The supervisory authority responsible for the Institute for Federal Real Estate is the Federal Commissioner for Data Protection and Freedom of Information: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit, Husarenstraße 30, D-53117 Bonn, tel.: +49 (0)228 997799-0, fax: +49 (0)228 997799-5550, email: firstname.lastname@example.org.
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) (data processing based on the weighing of legitimate interests).
Should you exercise your right to object, we will no longer process your personal data, unless we can demonstrate compelling legitimate interests in the processing which override your interests or fundamental rights or freedoms, or the processing serves the establishment, exercise or defence of legal claims.
We only process your personal data to the extent necessary to ensure the proper working of our websites and to deliver our offers and services.
When you visit our websites, our web servers temporarily store every access in a log file. The following data are recorded and stored until they are automatically deleted after seven days:
These data are processed so that you can use our websites (connection set-up), for the purposes of system security, technical administration of the network infrastructure and to optimize our internet services. We therefore have an overriding legitimate interest in processing personal data in accordance with point (f) of Article 6(1) of the GDPR.
A session cookie with a session ID and a cookie with log-in information are required for technical reasons so that web pages and all their functionalities can work properly. We therefore have an overriding legitimate interest in processing personal data in accordance with point (f) of Article 6(1) of the GDPR.
We use the Universal Analytics version of Google Analytics, a web analysis service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. It allows data, sessions and interaction across several devices to be assigned a pseudonymous user ID and thus user activity across devices to be analysed.
You can stop cookies being stored on your device by changing the settings in your browser. Please note that if you do so, you may no longer be able to use all our website functions. You can also prevent the data generated via cookies and data linked to your use of our websites being recorded and prevent Google processing these data by downloading and installing the Browser Add-on. This add-on prevents Google Analytics using your data. To stop Universal Analytics recording data across various devices, you must run the add-on on all the systems you use. To set the opt-out cookie click here: Deactivate Google Analytics.
Our websites use the Google Analytics "demographic features" function. This enables reports to be created containing the age, gender and interests of people visiting our sites. These data relate to interest-based Google advertising and third-party user data, and they cannot be assigned to a specific individual. You can deactivate this function at any time via the ad setting in your Google account or you can generally prohibit your data being recorded by Google Analytics as described in the above.
A number of contact forms are provided. They make it easy for you to contact us.
The web server sends all the personal data collected in a contact form to the relevant office in the Institute for Federal Real Estate in an email. These data are not stored on our web server. The data are not encrypted when transmitted.
Your details are only processed for the purpose for which you sent your enquiry. Point (b) of Article 6(1) of the GDPR provides the legal basis for the processing of your personal data, insofar as the data are required to take those steps prior to entering into a contract which are necessary based on your enquiry. The processing of any other data which you provide to us is based on point (a) of Article 6(1) of the GDPR (consent).
Data in contact forms which do not lead to the conclusion of a contract are deleted without delay. Should we conclude a contract with you, the data required in the performance of that contract are stored as long as is necessary.
The "meine BImA" portal provides access to a number of services. You must register on the "meine BImA" portal to use these services.
Once you have successfully registered, we will also process those data which you enter in the course of using "meine BImA". Your personal data will only be stored in connection with the specific service you are using and only as long as is necessary to provide that service to you.
You can deactivate your account at any time via Profile – Security – More. As far as is technically feasible, all those personal data which we have stored for the purposes of providing services via "meine BImA" will be deleted; if this is not possible, the data will be anonymized so that the specific data subject can no longer be identified.
Point (a) of Article 6(1) of the GDPR (consent) provides the legal basis for the processing of your personal data for the purpose of using "meine BImA".
We reserve the right to use those anonymized data which are recorded in the course of your using "meine BImA" for statistical analysis purposes in order to improve our services. It will not be possible to identify the specific data subject.
If you complete the registration process for a newsletter service, this is interpreted as consent to the processing of your personal data for that purpose. We will then store the data required for the relevant newsletter service as well as proof that you have given your consent. Point (a) of Article 6(1) of the GDPR provides the legal basis for the processing of your personal data for the purposes of providing newsletter services.
You have the right to withdraw your consent at any time. To do so, either follow the link provided in each newsletter or deselect the newsletter in your "meine BImA" profile.
Our real estate portal is operated in cooperation with Immobilien Scout GmbH, Andreasstraße 10, 10243 Berlin, Germany via an interface (ImmobilienScout-API). We integrate images on our website which are retrieved from Immobilien Scout GmbHʼs servers.
We use images provided by Immobilien Scout GmbH in the interests of making our websites visually appealing. This represents a legitimate interest in accordance with point (f) of Article 6(1) of the GDPR.
Our websites use Google Maps via an interface (API) to visualize geographical information. Google Maps is a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
We use Google Maps in the interests of making our websites visually appealing and making it easier for you to locate the buildings/places to which reference is made on our websites. This represents a legitimate interest in accordance with point (f) of Article 6(1) of the GDPR.
We embed videos provided by Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA on our websites.
We embed videos provided by Vimeo Inc. in the interests of making our websites visually appealing. This represents a legitimate interest in accordance with point (f) of Article 6(1) of the GDPR.
Those offices within the Institute for Federal Real Estate which require your data to perform their tasks and fulfil their contractual and statutory obligations have access to your data.
We use third-party services providers (processors) to process data in accordance with Article 28 of the GDPR. We may also contract skilled trade firms and other specialized firms to fulfil our contractual obligations. We will disclose the data required to provide the service in question to the aforementioned third parties.
In all other cases, we may only disclose your personal data when required to do so by law or where this is necessary for each specific purpose.
We will store your personal data for as long as we are required to do so by law. Your data will be deleted after the end of the statutory retention period, unless they are required in the context of performance of a contract or the intention to enter into a contract and/or we have a legitimate interest in continuing to store them. If the exercise of rights of intervention require that they be deleted, the relevant data will be deleted without delay.
You must provide all those personal data which are necessary so that we can enter into and conduct a business relationship with you and so that we can perform the related contractual obligations, as well as those which we are required to collect by law. Without these data we will generally not be able to enter into the contract with you or to execute the contract.
We are required, for example, to obtain your consent for documentation purposes and to store that consent on the basis of statutory requirements (point (c) of Article 6(1) in conjunction with Article 7(1) of the GDPR).
As at: 25 February 2019