I Privacy policy
We are pleased that you are visiting our website. We respect your privacy. Data protection and data security when using our website are very important to us. With this privacy policy, we would like to inform you about the extent to which data is processed and for what purposes personal data is processed when you use the website.
II Person responsible
NEULAND Wohnungsgesellschaft mbH
Erfurter Ring 15
38444 Wolfsburg
Germany
Phone: 05361/791 0
E-mail: service(at)nld.de
Register court: Braunschweig
Register number: HRB 100013
III Contact details of the data protection officer
Treuhandstelle für Wohnungsunternehmen in Bayern GmbH
Stollbergstraße 7
80539 Munich
IV Data security
The personal data of every individual who has a contractual, pre-contractual or other relationship with our company deserves special protection. We aim to maintain a high standard of data protection. That is why we are committed to the continuous development of our data protection and data security concepts. We are therefore committed to protecting your privacy and treating your personal data confidentially. In order to prevent manipulation, loss or misuse of your data stored with us, we take extensive technical and organisational security measures, which are regularly reviewed and adapted to technological progress. This includes, among other things, the use of recognised encryption methods (SSL or TLS). However, we would like to point out that, due to the structure of the internet, it is possible that the rules of data protection and the above-mentioned security measures may not be observed by other persons or institutions outside our area of responsibility. In particular, unencrypted data – e.g. when sent by email – may be read by third parties. We have no technical influence on this. It is the user's responsibility to protect the data they provide against misuse by means of encryption or other methods.
a. Type and purpose of processing
When you access our website, i.e. if you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of browser, the operating system used, the domain name of your Internet service provider, your IP address and similar information. This is exclusively information that does not allow any conclusions to be drawn about your person. It is processed in particular for the following purposes:
- ensuring a smooth connection to the website,
- ensuring the smooth use of our website,
- evaluating system security and stability, and
- for other administrative purposes.
We do not use your data to draw conclusions about your person. We may statistically evaluate information of this kind in order to optimise our website and the technology behind it.
b. Legal basis for processing
Processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website and its provision.
c. Data categories
Date and time of the website visit, IP address (host name of the accessing computer), operating system and browser type/version used, search terms used, referrer URL (previously visited website)
d. Recipients
The recipients of the data are employees of the corporate communications department and our web host Mittwald CM Service GmbH & Co. KG in their capacity as processors, who are responsible for the operation and maintenance of our website.
e. Storage periods
The data is deleted as soon as it is no longer required for the purpose for which it was collected. For data used to provide the website, this is generally the case when the respective session has ended.
f. Legal/contractual requirement
The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, individual services may be unavailable or restricted.
g. Transfer to third countries
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).
h. Automated decision-making and profiling
As a responsible company, we refrain from automatic decision-making or profiling in this data processing.
V. Forms
Repair notification, contact form, contact form for someone else, enquiry form for businesses, WELTraum order form, enquiry form for tenants
VI Newsletter
VII Cookies
VIII Google Tag Manager
a. Type and purpose of processing
We use the service called Google Tag Manager from Google. "Google" is a group of companies consisting of Google Ireland Ltd. (provider of the service), Gordon House, Barrow Street, Dublin 4, Ireland, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and other companies affiliated with Google LLC.We have concluded a data processing agreement with Google. Google Tag Manager is a support service and only processes personal data for technically necessary purposes. Google Tag Manager ensures that other components are loaded, which in turn may collect data. Google Tag Manager does not access this data. Further information on Google Tag Manager can be found in Google's privacy policy. Please note that American authorities, such as intelligence agencies, may be able to access personal data that is inevitably exchanged with Google when this service is integrated due to American laws such as the Cloud Act.
b. Legal basis for processing
The processing of the data entered is based on the consent of the user (Art. 6 para. 1 lit. a GDPR).
c. Data categories
IP address
d. Recipients
The recipients of the data are internal employees of the corporate communications department and Google as the processor. We have concluded the relevant data processing agreement with Google for this purpose.
e. Storage periods
Data will only be processed in this context as long as the relevant consent has been given. After that, it will be deleted, provided that there are no legal retention obligations to the contrary. To contact us in this regard, please use the contact details provided at the beginning of this privacy policy.
f. Legal basis for processing
The provision of your personal data is voluntary and based solely on your consent. If you prevent access, this may result in functional restrictions on the website.
g. Transfer to third countries
Google Tag Manager is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager collects your IP address, which may also be transferred to Google's parent company in the United States (Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043-1351). Google is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the US that is intended to ensure compliance with European data protection standards when processing data in the US. Every company certified under the DPF undertakes to comply with these data protection standards.
Further information on this can be obtained from the provider at the following link: www.dataprivacyframework.gov/
h. Revocation of consent
You can withdraw your consent at any time with future effect by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until withdrawal remains unaffected.
You can prevent the storage of cookies by adjusting your browser software settings accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.
IX Google Analytics
If you have given your consent, Google Analytics 4, a web analytics service provided by Google LLC, is used on this website. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
Type and purpose of processing
Google Analytics uses cookies that enable your use of our website to be analysed. The information collected by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there. We use Google Signals. This enables Google Analytics to collect additional information about users who have activated personalised ads (interests and demographic data) and ads can be delivered to these users in cross-device remarketing campaigns.
In Google Analytics 4, the anonymisation of IP addresses is activated by default. Due to IP anonymisation, your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. During your visit to the website, your user behaviour is recorded in the form of "events". Events can be
- Page views
- First visit to the website
- Start of the session
- Visited web pages
- Your "click path", interaction with the website
- Scrolls (whenever a user scrolls to the bottom of the page (90%))
- Clicks on external links
- Internal search queries
- Interaction with videos
- file downloads
- Ads viewed / clicked on
- language setting
Also recorded:
- Your approximate location (region)
- Date and time of your visit
- Your IP address (in truncated form)
- Technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
- Your internet provider
- the referrer URL (via which website/advertising medium you came to this website)
Purposes of the processing
On behalf of the operator of this website, Google will use this information to analyse your pseudonymous use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website and the success of our marketing campaigns.
Recipients
Recipients of the data are/may be
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
- Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
- Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Third country transfer
The European Commission adopted its adequacy decision for the USA on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider.
Storage period
The data sent by us and linked to cookies is automatically deleted after 2 months. The maximum lifespan of Google Analytics cookies is 2 years. Data whose retention period has been reached is automatically deleted once a month.
Legal basis
The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 sentence 1 TTDSG.
Revocation of consent
You can withdraw your consent at any time with effect for the future by accessing the cookie settings Link is requested from TRITUM and changing your selection there. This does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.
You can also prevent the storage of cookies from the outset by configuring your browser software accordingly. However, if you configure your browser to reject all cookies, this may restrict the functionality of this and other websites. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by
- not giving your consent to the setting of cookies or
- downloading and installing the browser add-on to deactivate Google Analytics HERE.
You can find more information on the terms of use of Google Analytics and on data protection at Google at https://marketingplatform.google.com/about/analytics/terms/de/ and at https://policies.google.com/?hl=de.
X YouTube videos
a. Type and purpose of processing
We embed YouTube videos on some of our websites. The operator of the corresponding plugins is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. When you visit a page with the YouTube plugin, a connection to YouTube servers is established. YouTube is informed which pages you visit. If you are logged into your YouTube account, YouTube can assign your surfing behaviour to you personally. You can prevent this by logging out of your YouTube account beforehand. If a YouTube video is started, the provider uses cookies that collect information about user behaviour. Further information on the purpose and scope of data collection and its processing by YouTube can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy(www.google.de/intl/de/policies/privacy/).
b. Legal basis of the processing
The legal basis for the integration of YouTube and the associated data transfer to Google is your consent (Art. 6 para. 1 lit. a GDPR).
c. Data categories
IP address is stored anonymously and the search behaviour
d. Recipients
Recipients of the data are internal employees of Corporate Communications and Google as service provider.
e. Storage periods
If you have deactivated the storage of cookies for the Google Ad programme, you will not have to expect any such cookies when watching YouTube videos. However, YouTube also stores non-personalised usage information in other cookies. If you wish to prevent this, you must block the storage of cookies in your browser. Further information on data protection at "YouTube" can be found in the provider's privacy policy at: www.google.de/intl/de/policies/privacy/
f. Legal / contractual requirement
The provision of your personal data is voluntary, solely on the basis of your consent. If you prevent access, this may result in functional restrictions on the website.
g. Transfer to third countries
Google processes your data in the USA and has submitted to the EU_US Privacy Shield www.privacyshield.gov/EU-US-Framework. Based on this agreement between the USA and the European Commission, the latter has determined an adequate level of data protection for companies certified under the Privacy Shield. As Google servers are distributed worldwide and a transfer to third countries (e.g. Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider.
h. Revocation of consent
You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. This does not affect the lawfulness of the processing carried out on the basis of your consent until you withdraw it.
i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing. Information on whether and how Google uses your data for profiling or automated decisions can be found in their privacy policy(https://www.google.de/intl/de/policies/privacy/).
XI Map service openstreetmap.de
XII Meta pixel
Meta pixels and target group formation (custom audiences)
With the help of the Meta Pixel, Meta is able to identify visitors to our online offering as a target group for the display of advertisements ("Meta Ads"). We use Meta Ads and Meta Pixel to market our flats, advertise our services and recruit staff.
We use the Meta Pixel to display the Meta Ads we place only to users on Meta platforms and within the services of Meta's cooperating partners (the so-called "Audience Network" https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online offering or who have certain characteristics (e.g. interest in certain topics or products, which can be seen from the websites visited) that we transmit to Meta (so-called "Custom Audiences"). With the help of the Meta pixel, we also want to ensure that our Meta ads correspond to the potential interest of users and do not appear intrusive. With the help of the Meta pixel, we can also track the effectiveness of Meta ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Meta ad (so-called "conversion measurement"); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: consent (Art. 6(1)(a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for third country transfers: EU-US Data Privacy Framework (DPF), standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: User event data, i.e. behavioural and interest information, is processed for the purposes of targeted advertising and target group formation on the basis of the joint responsibility agreement ("Addendum for Controllers", https://www.facebook.com/legal/controller_addendum). Joint responsibility is limited to the collection and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of data to the parent company Meta Platforms, Inc. in the USA (based on the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.). The website operator has concluded the above-mentioned addendum for controllers and Meta Ireland in order to define the respective responsibilities for fulfilling the obligations under the GDPR with regard to joint processing (as specified in the terms of use for covered products: https://www.facebook.com/legal/terms/businesstools; https://www.facebook.com/legal/terms/customaudience).
The website operator and Meta Ireland have agreed that Meta Ireland is responsible for enabling the rights of data subjects under Articles 15-20 of the GDPR with regard to the personal data stored by Meta Ireland following joint processing. Further information on how Meta Ireland processes personal data, including the legal basis on which Meta Ireland relies and the options for exercising data subjects' rights vis-à-vis Meta Ireland, can be found in Meta Ireland's privacy policy at https://www.facebook.com/about/privacy.
XIII Links to other providers
Our website also contains links to websites of other providers that are not covered by our privacy policy. As a rule, we have no influence on the content and compliance with data protection regulations by these providers and therefore ask you to inform yourself about the applicable guidelines when visiting these websites.
XIV Rights of data subjects
If you, as a user, process personal data, you are considered a data subject under the GDPR. Data subjects have the following rights vis-à-vis the controller:
- Right of access (Art. 15 GDPR)
- Right to rectification or erasure of personal data (Art. 16, 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to be informed in connection with the rectification or erasure of your personal data or the restriction of processing (Art. 19 GDPR)
- Right to data portability (Art. 20 GDPR) Right to object (Art. 21 GDPR)
- Right to withdraw consent. The lawfulness of data processing carried out until withdrawal remains unaffected by the consent given to date. (Art. 7(3) GDPR)
- Right to lodge a complaint with the supervisory authority (Art. 77 GDPR)
XV Our right to amend the Directive
As changes to the law or changes to our internal company processes may require adjustments to this privacy policy, we ask that you review this privacy policy regularly. We reserve the right to change these guidelines at any time in accordance with data protection regulations.