I Privacy policy
We are pleased that you are visiting our website. We respect your privacy. Data protection and data security when using our website are very important to us. With this privacy policy, we would like to inform you about the extent to which data is processed and for what purposes personal data is processed when you use the website.
II Person responsible
NEULAND Wohnungsgesellschaft mbH
Erfurter Ring 15
38444 Wolfsburg
Germany
Phone: 05361/791 0
E-mail: service(at)nld.de
Register court: Braunschweig
Register number: HRB 100013
III Contact details of the data protection officer
Treuhandstelle für Wohnungsunternehmen in Bayern GmbH
Stollbergstraße 7
80539 Munich
IV Data security
The personal data of every individual who has a contractual, pre-contractual or other relationship with our company deserves special protection. We aim to maintain a high standard of data protection. That is why we are committed to the continuous development of our data protection and data security concepts. We are therefore committed to protecting your privacy and treating your personal data confidentially. In order to prevent manipulation, loss or misuse of your data stored with us, we take extensive technical and organisational security measures, which are regularly reviewed and adapted to technological progress. This includes, among other things, the use of recognised encryption methods (SSL or TLS). However, we would like to point out that, due to the structure of the internet, it is possible that the rules of data protection and the above-mentioned security measures may not be observed by other persons or institutions outside our area of responsibility. In particular, unencrypted data – e.g. when sent by email – may be read by third parties. We have no technical influence on this. It is the user's responsibility to protect the data they provide against misuse by means of encryption or other methods.
a. Type and purpose of processing
When you access our website, i.e. if you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of browser, the operating system used, the domain name of your Internet service provider, your IP address and similar information. This is exclusively information that does not allow any conclusions to be drawn about your person. It is processed in particular for the following purposes:
- ensuring a smooth connection to the website,
- ensuring the smooth use of our website,
- evaluating system security and stability, and
- for other administrative purposes.
We do not use your data to draw conclusions about your person. We may statistically evaluate information of this kind in order to optimise our website and the technology behind it.
b. Legal basis for processing
Processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website and its provision.
c. Data categories
Date and time of the website visit, IP address (host name of the accessing computer), operating system and browser type/version used, search terms used, referrer URL (previously visited website)
d. Recipients
The recipients of the data are employees of the corporate communications department and our web host Mittwald CM Service GmbH & Co. KG in their capacity as processors, who are responsible for the operation and maintenance of our website.
e. Storage periods
The data is deleted as soon as it is no longer required for the purpose for which it was collected. For data used to provide the website, this is generally the case when the respective session has ended.
f. Legal/contractual requirement
The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, individual services may be unavailable or restricted.
g. Transfer to third countries
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).
h. Automated decision-making and profiling
As a responsible company, we refrain from automatic decision-making or profiling in this data processing.
V. Forms
Repair report, contact form, contact form for another person, WELTraum order form (dispatch by post)
a. Type and purpose of processing
The data you enter will be stored for the purpose of personalised communication with you. This requires you to provide a valid e-mail address and your name. This is used to allocate the enquiry and subsequently answer it. The provision of further data is optional.
b. Legal basis of the processing
The data entered in the forms is processed on the basis of a legitimate interest (Art. 6 para. 1 lit. f GDPR). By providing the forms, we want to make it easy for you to contact us. The information you provide will be stored for the purpose of processing your enquiry and for possible follow-up questions. If you contact us to request a quotation, the data entered in the forms will be processed to fulfil (pre-)contractual measures (Art. 6 para. 1 lit. b GDPR).
c. Data categories
Name, email address, address, subject and your message text
d. Recipients
The recipients of the data are internal employees of the relevant departments and our web host Mittwald CM Service GmbH & Co. KG as the processor.
e. Storage periods
Data will be deleted no later than 6 months after the enquiry has been processed. If there is a contractual relationship or other reasons for a statutory retention period, we will delete your data after these periods have expired.
f. Legal / contractual requirement
The provision of your personal data is voluntary. However, we can only process your enquiry if you provide us with your name, email address and the reason for the enquiry.
g. Transfer to third countries
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).
h. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.
i. Deviating privacy policy for the form for prospective tenants
The following data protection information applies to the form "Interested party form for prospective tenants".
VI Processing of data of interested parties
Flats (prospective tenants)
Further information on the processing of personal data of prospective tenants in the area of flats can be found here:
Data protection information.
Commercial (prospective tenants)
Further information on the processing of personal data of prospective tenants in the commercial sector can be found here:
Data protection information.
VII. Newsletter
a. Type and purpose of processing
Your data will be used exclusively to send you the WELTraum Newsletter or NEULAND Newsletter by e-mail. Your name is provided in order to be able to address you personally in the newsletter and, if necessary, to identify you if you wish to exercise your rights as a data subject. To receive the newsletter, it is sufficient to provide your name and e-mail address. When you register to receive our newsletter, the data you provide will be used exclusively for this purpose. Subscribers may also be informed by e-mail about circumstances that are relevant to the service or registration (e.g. changes to the newsletter offer or technical circumstances). We require a valid e-mail address for an effective registration. We use the "double opt-in" procedure to check that a registration is actually made by the owner of an e-mail address. For this purpose, we log the subscription to the newsletter, the sending of a confirmation email and the receipt of the requested reply. No further data is collected. The data is used exclusively for sending the newsletter and is not passed on to third parties.
b. Legal basis of the processing
On the basis of your expressly granted consent (Art. 6 para. 1 lit. a GDPR, Art. 7 GDPR), we will regularly send you our newsletter or comparable information by e-mail to the e-mail address you have provided.
c. Data categories
E-mail address
d. Recipients
The recipients of the data are internal employees of Corporate Communications and Sendinblue GmbH as the processor. We have concluded the corresponding data processing agreement with Sendinblue GmbH for this purpose.
e. Storage periods
The data will only be processed in this context for as long as the corresponding consent is available. It will then be deleted.
f. Legal / contractual requirement
The provision of your personal data is voluntary, solely on the basis of your consent. Unfortunately, we cannot send you our newsletter without your consent.
g. Transfer to third countries
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).
h. Revocation of consent
You can revoke your consent to the storage of your personal data and its use for sending the newsletter at any time with effect for the future. There is a corresponding link in every newsletter. You can also unsubscribe directly on this website at any time or inform us of your cancellation using the contact option provided at the beginning of this privacy policy.
g. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.
VIII Cookies
a. Type and purpose of processing
Like many other websites, we also use so-called "cookies".
Cookies are simple files that store information about our website and your use of it. These small files are optionally created automatically by your browser when you use our website and stored locally on your end device. This does not mean that we have direct knowledge of your identity. The use of cookies serves to make the use of our website more pleasant for you.
We therefore distinguish between technically necessary and non-essential cookies:
Technically necessary cookies ("first party cookies")
are required for the operation of a website and are essential in order to navigate it and use its functions. These cookies are not stored permanently on your computer or device and are deleted after expiry (see table below). These are so-called session cookies or session cookies.
For all technically necessary cookies, Neuland is the provider with the address NEULAND Wohnungsgesellschaft mbH, Erfurter Ring 15, 38444 Wolfsburg.
Cookies that are not necessary
On the other hand, non-necessary cookies are mostly functional cookies, performance cookies and marketing third party cookies, which make it possible, for example, to record and count the number of visitors and traffic sources in order to measure and improve the performance of the website. They are also used to find out whether problems or errors occur on certain pages, which pages are the most popular and how visitors navigate the website.
- Functional cookies are used to store information provided, such as the user name or language selection, and thus offer the website visitor improved and personalised functions based on this.
- Performance cookies are used to track visits and individual activities on websites. They are used to statistically record and analyse the use of websites.
- Marketing & third party cookies originate from external advertising companies, among others, and are used to collect information about the websites visited by the user, e.g. to create target group-orientated advertising for the user.
b. Legal basis of the processing
The use of technically necessary cookies ("first party cookies") is possible without the consent of the website visitor in accordance with § 25 para. 1 TTDSG and is subject to a legitimate interest in the economic operation and optimisation of our website and services) within the meaning of Art. 6 para. 1 sentence 1 lit. f DS-GVO and the provision of the website within the meaning of Art. 6 para. 1 lit. b DS-GVO.
The use of non-essential cookies, such as functional cookies, performance cookies and marketing & third party cookies, is subject to the consent of the website visitor in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
c. Data categories
Described in the cookies section
d. Recipients
Described in the cookies section
e. Storage periods
The user can set their web browser so that the storage of cookies on their end device is generally prevented or they are asked each time whether they agree to the setting of cookies. Once cookies have been set, the user can delete them at any time. How this works is described in the help function of the respective web browser.
A general deactivation of cookies may lead to functional restrictions on this website.
Otherwise, cookies are deleted after expiry (see section above).
f. Legal / contractual requirement
The provision of your personal data in cookies is voluntary in the case of non-essential cookies, solely on the basis of your consent. You can also prevent the use of pre-set, technically necessary cookies via your browser settings. Without this, however, the service and functionality of our website cannot be guaranteed. In addition, individual services may not be available or may be restricted.
g. Transfer to third countries
In principle, processing does not take place outside the European Union (EU) or the European Economic Area (EEA). In cases where processing takes place outside the European Union (EU) or the European Economic Area (EEA), you will find the relevant information in this privacy policy.
h. Revocation of consent
You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. This does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.
i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling when collecting technically necessary cookies. If this takes place in the context of non-essential cookies or third parties, you will find the relevant information in this privacy policy.
IX Google Tag Manager
a. Type and purpose of processing
We use the service called Google Tag Manager from Google. "Google" is a group of companies consisting of Google Ireland Ltd. (provider of the service), Gordon House, Barrow Street, Dublin 4, Ireland, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and other companies affiliated with Google LLC.We have concluded a data processing agreement with Google. Google Tag Manager is a support service and only processes personal data for technically necessary purposes. Google Tag Manager ensures that other components are loaded, which in turn may collect data. Google Tag Manager does not access this data. Further information on Google Tag Manager can be found in Google's privacy policy. Please note that American authorities, such as intelligence agencies, may be able to access personal data that is inevitably exchanged with Google when this service is integrated due to American laws such as the Cloud Act.
b. Legal basis for processing
The processing of the data entered is based on the consent of the user (Art. 6 para. 1 lit. a GDPR).
c. Data categories
IP address
d. Recipients
The recipients of the data are internal employees of the corporate communications department and Google as the processor. We have concluded the relevant data processing agreement with Google for this purpose.
e. Storage periods
Data will only be processed in this context as long as the relevant consent has been given. After that, it will be deleted, provided that there are no legal retention obligations to the contrary. To contact us in this regard, please use the contact details provided at the beginning of this privacy policy.
f. Legal basis for processing
The provision of your personal data is voluntary and based solely on your consent. If you prevent access, this may result in functional restrictions on the website.
g. Transfer to third countries
Google Tag Manager is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager collects your IP address, which may also be transferred to Google's parent company in the United States (Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043-1351). Google is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the US that is intended to ensure compliance with European data protection standards when processing data in the US. Every company certified under the DPF undertakes to comply with these data protection standards.
Further information on this can be obtained from the provider at the following link: www.dataprivacyframework.gov/
h. Revocation of consent
You can withdraw your consent at any time with future effect by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until withdrawal remains unaffected.
You can prevent the storage of cookies by adjusting your browser software settings accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.
X Google Analytics
If you have given your consent, Google Analytics 4, a web analytics service provided by Google LLC, is used on this website. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
Type and purpose of processing
Google Analytics uses cookies that enable your use of our website to be analysed. The information collected by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there. We use Google Signals. This enables Google Analytics to collect additional information about users who have activated personalised ads (interests and demographic data) and ads can be delivered to these users in cross-device remarketing campaigns.
In Google Analytics 4, the anonymisation of IP addresses is activated by default. Due to IP anonymisation, your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. During your visit to the website, your user behaviour is recorded in the form of "events". Events can be
- Page views
- First visit to the website
- Start of the session
- Visited web pages
- Your "click path", interaction with the website
- Scrolls (whenever a user scrolls to the bottom of the page (90%))
- Clicks on external links
- Internal search queries
- Interaction with videos
- file downloads
- Ads viewed / clicked on
- language setting
Also recorded:
- Your approximate location (region)
- Date and time of your visit
- Your IP address (in truncated form)
- Technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
- Your internet provider
- the referrer URL (via which website/advertising medium you came to this website)
Purposes of the processing
On behalf of the operator of this website, Google will use this information to analyse your pseudonymous use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website and the success of our marketing campaigns.
Recipients
Recipients of the data are/may be
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
- Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
- Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Third country transfer
The European Commission adopted its adequacy decision for the USA on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider.
Storage period
The data sent by us and linked to cookies is automatically deleted after 2 months. The maximum lifespan of Google Analytics cookies is 2 years. Data whose retention period has been reached is automatically deleted once a month.
Legal basis
The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 sentence 1 TTDSG.
Revocation of consent
You can withdraw your consent at any time with effect for the future by accessing the cookie settings Link is requested from TRITUM and changing your selection there. This does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.
You can also prevent the storage of cookies from the outset by configuring your browser software accordingly. However, if you configure your browser to reject all cookies, this may restrict the functionality of this and other websites. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by
- not giving your consent to the setting of cookies or
- downloading and installing the browser add-on to deactivate Google Analytics HERE.
You can find more information on the terms of use of Google Analytics and on data protection at Google at https://marketingplatform.google.com/about/analytics/terms/de/ and at https://policies.google.com/?hl=de.
XI YouTube videos
a. Type and purpose of processing
We embed YouTube videos on some of our websites. The operator of the corresponding plugins is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. When you visit a page with the YouTube plugin, a connection to YouTube servers is established. YouTube is informed which pages you visit. If you are logged into your YouTube account, YouTube can assign your surfing behaviour to you personally. You can prevent this by logging out of your YouTube account beforehand. If a YouTube video is started, the provider uses cookies that collect information about user behaviour. Further information on the purpose and scope of data collection and its processing by YouTube can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy(www.google.de/intl/de/policies/privacy/).
b. Legal basis of the processing
The legal basis for the integration of YouTube and the associated data transfer to Google is your consent (Art. 6 para. 1 lit. a GDPR).
c. Data categories
IP address is stored anonymously and the search behaviour
d. Recipients
Recipients of the data are internal employees of Corporate Communications and Google as service provider.
e. Storage periods
If you have deactivated the storage of cookies for the Google Ad programme, you will not have to expect any such cookies when watching YouTube videos. However, YouTube also stores non-personalised usage information in other cookies. If you wish to prevent this, you must block the storage of cookies in your browser. Further information on data protection at "YouTube" can be found in the provider's privacy policy at: www.google.de/intl/de/policies/privacy/
f. Legal / contractual requirement
The provision of your personal data is voluntary, solely on the basis of your consent. If you prevent access, this may result in functional restrictions on the website.
g. Transfer to third countries
Google processes your data in the USA and has submitted to the EU_US Privacy Shield www.privacyshield.gov/EU-US-Framework. Based on this agreement between the USA and the European Commission, the latter has determined an adequate level of data protection for companies certified under the Privacy Shield. As Google servers are distributed worldwide and a transfer to third countries (e.g. Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider.
h. Revocation of consent
You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. This does not affect the lawfulness of the processing carried out on the basis of your consent until you withdraw it.
i. Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing. Information on whether and how Google uses your data for profiling or automated decisions can be found in their privacy policy(https://www.google.de/intl/de/policies/privacy/).
XII Map service openstreetmap.de
We integrate maps from the "OpenStreetMap" service using the JavaScript library Leaflet, which are offered by the OpenStreetMap Foundation (OSMF) on the basis of the Open Data Commons Open Database Licence (ODbL). The privacy policy of the OpenStreetMap Foundation can be found here: https://wiki.osmfoundation.org/wiki/Privacy_Policy.
Our website obtains the map content from https://www.openstreetmap.org(https://www.openstreetmap.org/copyright).
To the best of our knowledge, your data is used by OpenStreetMap exclusively for the purpose of displaying the map functions and temporarily storing the selected settings. This data may include in particular
- IP address for the delivery of data, storage in logs is anonymised
- Browser and device type
- operating system
- the fact that you are accessing OpenStreetMap content from this website and the date and time of the request.
According to our information, this data is processed on servers in the Federal Republic of Germany and sometimes the Netherlands and is subject to the EU GDPR.
XIII Meta pixel
Meta pixels and target group formation (custom audiences)
With the help of the Meta Pixel, Meta is able to identify visitors to our online offering as a target group for the display of advertisements ("Meta Ads"). We use Meta Ads and Meta Pixel to market our flats, advertise our services and recruit staff.
We use the Meta Pixel to display the Meta Ads we place only to users on Meta platforms and within the services of Meta's cooperating partners (the so-called "Audience Network" https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online offering or who have certain characteristics (e.g. interest in certain topics or products, which can be seen from the websites visited) that we transmit to Meta (so-called "Custom Audiences"). With the help of the Meta pixel, we also want to ensure that our Meta ads correspond to the potential interest of users and do not appear intrusive. With the help of the Meta pixel, we can also track the effectiveness of Meta ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Meta ad (so-called "conversion measurement"); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: consent (Art. 6(1)(a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for third country transfers: EU-US Data Privacy Framework (DPF), standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: User event data, i.e. behavioural and interest information, is processed for the purposes of targeted advertising and target group formation on the basis of the joint responsibility agreement ("Addendum for Controllers", https://www.facebook.com/legal/controller_addendum). Joint responsibility is limited to the collection and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of data to the parent company Meta Platforms, Inc. in the USA (based on the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.). The website operator has concluded the above-mentioned addendum for controllers and Meta Ireland in order to define the respective responsibilities for fulfilling the obligations under the GDPR with regard to joint processing (as specified in the terms of use for covered products: https://www.facebook.com/legal/terms/businesstools; https://www.facebook.com/legal/terms/customaudience).
The website operator and Meta Ireland have agreed that Meta Ireland is responsible for enabling the rights of data subjects under Articles 15-20 of the GDPR with regard to the personal data stored by Meta Ireland following joint processing. Further information on how Meta Ireland processes personal data, including the legal basis on which Meta Ireland relies and the options for exercising data subjects' rights vis-à-vis Meta Ireland, can be found in Meta Ireland's privacy policy at https://www.facebook.com/about/privacy.
XIV Links to other providers
Our website also contains links to websites of other providers that are not covered by our privacy policy. As a rule, we have no influence on the content and compliance with data protection regulations by these providers and therefore ask you to inform yourself about the applicable guidelines when visiting these websites.
XV Rights of data subjects
If you, as a user, process personal data, you are considered a data subject under the GDPR. Data subjects have the following rights vis-à-vis the controller:
- Right of access (Art. 15 GDPR)
- Right to rectification or erasure of personal data (Art. 16, 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to be informed in connection with the rectification or erasure of your personal data or the restriction of processing (Art. 19 GDPR)
- Right to data portability (Art. 20 GDPR) Right to object (Art. 21 GDPR)
- Right to withdraw consent. The lawfulness of data processing carried out until withdrawal remains unaffected by the consent given to date. (Art. 7(3) GDPR)
- Right to lodge a complaint with the supervisory authority (Art. 77 GDPR)
XVI Our right to amend the Directive
As changes to the law or changes to our internal company processes may require adjustments to this privacy policy, we ask that you review this privacy policy regularly. We reserve the right to change these guidelines at any time in accordance with data protection regulations.