Privacy policy
This privacy policy explains how we process your personal data and outlines your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Deutsche Konsum REIT-AG (hereinafter referred to as "we" or "us") is the controller for data processing.
Contents
I. General Information
1. Contact
2. Legal Basis
3. Duration of Storage
4. Categories of Data Recipients
5. Data Transfer to Third Countries
6. Processing When Exercising Your Rights
7. Your Rights Under the General Data Protection Regulation
8. Right to Object
9. Data Protection Officer
II. Data Processing on Our Website
1. Processing of Server Log Files
2. Contact Options and Enquiries
3. Newsletter
4. Cookies
5. Consent Management Tool
6. Google Analytics
7. External Media and third-party Services
a) Google Maps
b) Google reCAPTCHA
c) Google Tag Manager
III. Data Processing on Our Social Media Pages
1. Visiting a Social Media Page
2. Communication via Social Media Pages
IV. Further Data Processing
1. Job Applications
2. Contacting Us
3. Customer and Prospect Data
4. Shareholders and Shareholder Representatives
I. General Information
1. Contact
If you have any questions or suggestions regarding this information, or if you wish to contact us to exercise your rights, please address your enquiry to
Deutsche Konsum REIT-AG
Business address:
Marlene-Dietrich-Allee 12b
14482 Potsdam
Telephone: +49 (0) 331 74 00 76 555
Email: info@deutsche-konsum.de
2. Legal Basis
The data protection term "personal data" refers to all information relating to an identified or identifiable natural person (‘data subject’). We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. We process personal data solely on the basis of legal authorization. We only process personal data with your consent ( Art. 6(1)(a) GDPR or Section 25(1) TDDDG), to fulfil a contract to which you are a party or at your request to carry out pre-contractual measures (Art. 6(1)(b) GDPR), to comply with a legal obligation (Art. 6(1)(c) GDPR) or if the processing is necessary to safeguard our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms requiring the protection of personal data prevail (Art. 6(1) (f) GDPR).
If you apply for a vacant position in our company, we will also process your personal data for the purpose of deciding whether to establish an employment relationship (Section 26(1) sent. 1 BDSG or Art. 6(1)(b) GDPR).
3. Duration of Storage
Unless otherwise specified in the following information, we only store personal data for as long as necessary to fulfil the purpose of processing or to meet our contractual or legal obligations. Such legal storage obligations may arise in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will store personal data contained in our accounting records for eight years and personal data contained in commercial correspondence and contracts for six years. In addition, we retain data relating to consents (for the purpose of proving consent) as well as concerning complaints and claims for the duration of the applicable statutory limitation periods. Data stored for advertising purposes will be deleted if you object to its processing.
4. Categories of Data Recipients
For certain processing activities, we rely on service providers. The processing operations carried out by such processors include, for example, hosting, email dispatch, maintenance and support of IT systems, customer and order management, accounting and billing or file and data carrier destruction. A processor is a natural or legal person, authority, institution or other body that processes personal data on behalf of the controller. Processors do not use the data for their own purposes. They process personal data exclusively on behalf of the controller and are contractually obliged to ensure appropriate technical and organizational measures for data protection. In addition, we may transfer your personal data to entities such as postal and delivery services, our bank, tax advisory/auditing companies or the tax authorities. Further recipients may be identified in the following information.
5. Data Transfer to Third Countries
Our data processing may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR is not applicable law. Such transfers are permissible if the European Commission has determined that an adequate level of data protection is provided in such a third country. If no such adequacy decision has been made by the European Commission, personal data will only be transferred to a third country if there are appropriate safeguards in place in accordance with Art. 46 GDPR or if one of the conditions set out in Art. 49 GDPR is met.
If no adequacy decision has been made and unless otherwise specified below, we use the EU standard data protection clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option of obtaining or viewing a copy of these EU standard data protection clauses. To do so, please contact us at the address provided under Contact.
If you consent to the transfer of personal data to third countries, the transfer will be carried out on the legal basis of Art. 49(1)(a) GDPR.
6. Processing When Exercising Your Rights
If you exercise your rights under Art. 15 to 22 GDPR, we will process the personal data you provide for the purpose of fulfilling your request and to be able to provide evidence of this. We will only process data stored for the purpose of providing information and preparing it for this purpose, as well as for data protection control purposes, and will otherwise restrict processing in accordance with Art. 18 GDPR.
This processing is based on the legal basis of Art. 6(1)(c) GDPR in conjunction with Art. 15 to 22 GDPR and Section 34(2) BDSG.
7. Your Rights Under the General Data Protection Regulation
As a data subject, you are entitled to exercise your rights under data protection law directly against us. In particular, you have the following rights:
• In accordance with Art. 15 GDPR and Section 34 BDSG, you have the right of request access to information about whether and, if so, to what extent we process personal data relating to you.
• Pursuant to Art. 16 GDPR, you have the right to request the rectification of inaccurate personal data.
• You have the right to request that we delete your personal data in accordance with Art. 17 GDPR and Section 35 BDSG.
• Under Art. 18 GDPR, you have the right to request the restriction of processing of your personal data.
• Pursuant to Art. 20 GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.
• If you have given us separate consent to process your data, you can withdraw this consent at any time in accordance with Art. 7(3) GDPR. Such withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.
• If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.
8. Right to Object
Pursuant to Art. 21(1) GDPR, you have the right to object to processing of your personal data based on Art. 6(1)(e) or (f) GDPR, for reasons arising from your particular situation. If we process your personal data for the purpose of direct marketing, you have the right to object to such processing at any time, in accordance with Art. 21(2) and (3) GDPR.
9. Data Protection Officer
You can contact our Data Protection Officer at the following address:
Email: datenschutzbeauftragter@deutsche-konsum.de
Herting Oberbeck Datenschutz GmbH
Hallerstr. 76, 20146 Hamburg
https://www.datenschutzkanzlei.de
II. Data Processing on Our Website
When you use our website, we collect information that you provide. We also automatically collect certain information about your use of the website. Under data protection law, IP addresses are considered personal data. An IP address is assigned to every device connected to the internet by the internet provider to enable the transmission and reception of data.
1. Processing of Server Log Files
When you use our website for purely informational purposes, general information transmitted by your browser is initially stored on our server (i.e. not via registration). This includes by default: browser type/version, operating system used, the page accessed, the previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code.
The processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6(1)(f) GDPR. This processing serves the technical administration and security of the website. The stored data is deleted after 60 days, unless there are concrete indications of unlawful use that require further investigation and processing. We are unable to identify you as a data subject based on the information collected. Art. 15 to 22 GDPR shall not apply in accordance with Art. 11(2) GDPR, unless you provide additional information that enables your identification, thereby allowing you to exercise the rights laid down in these articles.
2. Contact Options and Enquiries
Our website features a contact form designed to enable you to send us messages directly. The transfer of your data is encrypted (indicated by "https" in the address bar of your browser). All data fields marked as mandatory are required to process your request. If you do not provide this information, we will not be able to process your request. The provision of further data is voluntary. Alternatively, you can also send us a message via the contact email address. We process the data for the purpose of responding to your enquiry.
If your request relates to the conclusion or performance of a contract with us, Art. 6(1)(b) GDPR is the legal basis for data processing. In all other cases, we process your data based on our legitimate interest in communicating with individuals who contact us. The legal basis for this data processing is Art. 6(1)(f) GDPR.
3. Newsletter
You can subscribe to our newsletter on our website. Once subscribed, you will receive regular updates about our company and its latest news. To complete your subscription, a valid email address is required. For verification purposes, you will receive a confirmation email including a link that must be clicked to verify and activate your subscription (double opt-in). When you subscribe, we process personal data such as your email address and any additional information you provide in the registration form, based on the consent you have given. The legal basis for this processing is Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example by clicking the “Unsubscribe” link in any newsletter or by contacting us through the channels listed above. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
When you subscribe to the newsletter, we also store your IP address and the date and time of registration. The processing of this data is to demonstrate that you have given your consent. The legal basis for this is our legal obligation to document your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
We also analyze the reading behaviour and opening rates of our newsletter. For this purpose, we collect and process pseudonymized usage data, which is not combined with your email address or IP address. The legal basis for the analysis is Art. 6(1)(f) GDPR, as it serves our legitimate interest in optimizing our newsletter. You may object to this analysis at any time by contacting one of the channels mentioned above.
4. Cookies
We use cookies and similar technologies ("cookies") on our website. Cookies are small data files stored by your browser when you visit a website. They allow the browser to be recognized by web servers. You have full control over the use of cookies through your browser settings. You can delete cookies at any time in your browser’s security settings and object to their use either generally or in specific cases.
The use of cookies is technically necessary for the operation of our website and is therefore permitted without the user's consent. We may also use cookies to offer special functions and content, as well as for analysis and marketing purposes. These may also include third-party cookies. We only use such technically non-essential cookies with your consent in accordance with Section 25 (1) TDDDG and, where applicable, Art. 6(1)(a) GDPR. Information on the purposes, providers, technologies used, stored data and storage duration of individual cookies can be found in the cookie settings https://www.deutsche-konsum.de/ of our consent management tool.
5. Consent Management Tool
This website uses the consent management tool QICENT from QITEC GmbH (Germany) to control cookies and the processing of personal data.
The consent banner enables users of our website to give their consent to certain data processing procedures or to revoke consent that has already been given. By clicking on the "Accept all" button or by saving individual cookie settings, you consent to the use of the associated cookies.
The legal basis for data protection is your consent within the meaning of Art. 6(1)(a) GDPR.
In addition, the banner helps us to provide evidence of the declaration of consent. For this purpose, we process information about the declaration of consent and other log data relating to this declaration. Cookies are also used to collect this data. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis arises from our legal obligation to document your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
Here you can withdraw your consent to cookies: https://www.deutsche-konsum.de/
6. Google Analytics
We use the Google Analytics service provided by Google Ireland Limited (Ireland, EU) on our website.
Google Analytics is a web analytics service that helps us collect and analyze data about user behaviour on our website It enables us to measure interaction data across different devices and sessions, allowing us to contextualize individual user actions and analyze long-term relationships.
For this purpose, Google Analytics uses cookies that allow an analysis of website usage. In addition, personal data such as IP addresses, device identifiers, and interaction data with our website is processed. Some of this information is stored on the device you use.
Google Ireland processes this data on our behalf to evaluate website usage, compile reports on website activity, and provide additional services related to website and internet usage. Pseudonymous user profiles may be created from the processed data.
The setting of cookies and the subsequent processing of personal data as described herein is conducted based on your explicit consent. The legal basis for data processing in connection with the Google Analytics service is therefore Art. 6(1)(a) GDPR. Your consent can be withdrawn at any time with future effect via our consent management tool.
We only use Google Analytics with IP anonymization enabled. This implies that, within member states of the European Union and other contracting states to the Agreement on the European Economic Area, Google Ireland truncates the IP addresses of users. The IP address transmitted by the user's browser is not merged with other data. The IP address is truncated on servers in the EU.
User interaction data is stored for 2 months and then automatically deleted. Data whose storage period has expired is automatically deleted once a month.
Further information on how Google uses data from websites or apps for advertising purposes can be found in Google's information at:www.google.com/policies/technologies/ads/ .
7. External Media and third-party Services
a) Google Maps
We use Google Maps from Google Ireland Limited (Ireland, EU) on our website to display maps and for virtual tours. For such integration, it is technically necessary to process your IP address so that the content can be sent to your browser. Your IP address is therefore transmitted to Google, and Google may set its own cookies.
Your data is processed based on your consent in accordance with Art. 6(1)(a) GDPR.
When using the service, it cannot be excluded that your data may be transferred to the United States. Please also note the information in the section "Data transfer to third countries". Further information on data protection at Google can be found in Google's privacy policy at https://www.google.com/policies/privacy.
b) Google reCAPTCHA
When registering for the newsletter, we use the reCAPTCHA service provided by Google Ireland Limited (Ireland, EU). For such integration, it is technically necessary to process your IP address so that the content can be sent to your browser. Your IP address is therefore transmitted to Google Ireland. Google Ireland also collects other data, e.g. about your browser and your clicking behaviour. We use this service for security reasons to check whether form entries are made by a natural person. In this way, automated access attempts and attacks can be detected and repelled. We are legally obliged to take technically and economically reasonable measures to ensure the security of the portal.
Your data is processed based on Art. 6(1)(c) GDPR in conjunction with Art. 32 GDPR and Section 19(4) TDDDG.
When using the service, it cannot be excluded that your data may be transferred to the United States. Please note the information in the section "Data transfer to third countries". Further information on data protection at Google can be found in Google's privacy policy at https://www.google.com/policies/privacy
c) Google Tag Manager
We use Google Tag Manager from Google Ireland Limited (Ireland, EU) to manage website tags via an interface. The Tag Manager triggers other tags, which may collect data without accessing it themselves. Google Tag Manager is a cookie-free domain; however, the IP address is transmitted for technical reasons. If deactivation has been implemented at domain or cookie level, it remains effective for all tracking tags managed via Google Tag Manager.
Your data is processed based on your consent in accordance with Art. 6(1)(a) GDPR.
III. Data Processing on Our Social Media Pages
We operate a company page on the social media platform LinkedIn to provide further opportunities for sharing information about our company and engaging in dialogue.
When you visit or interact with our profile on LinkedIn, your personal data may be processed. The information associated with a social media profile also regularly constitutes personal data. This includes messages and statements made using the profile. In addition, certain information about your visit to our social media profile is frequently automatically collected, which may also qualify as personal data.
1. Visiting a Social Media Page
When you visit our social media page, where we present our company or individual products, certain information about you is processed. For this processing of personal data, LinkedIn acts as the sole controller. Further information on the processing of personal data can be found at the following link:
(https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy)
LinkedIn collects and processes event data and profile data and provides us with anonymized statistics and insights for our pages, which helps us to gain insights into the types of actions that people take on our page (so-called "Page Insights"). These Page Insights are generated based on aggregated information about visitors to our page. This processing is carried out by LinkedIn and us as joint controllers. The purpose of this processing is our legitimate interest in analyzing user interactions and improving our page based on these insights. The legal basis for this processing is Art. 6(1)(f) GDPR.
We cannot attribute the information obtained through Page Insights to individual user profiles. We have entered into an agreement with LinkedIn regarding joint controllership, which specifies the allocation of data protection obligations between us and LinkedIn. Details about the processing of personal data for Page Insights and the joint controller agreement can be found here:
(https://legal.linkedin.com/pages-joint-controller-addendum);
You may also exercise your rights directly against LinkedIn. Further information is available here:
(https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de);
We have agreed with LinkedIn that the Irish Data Protection Commission acts as the lead supervisory authority for Page Insights processing. You also have the right to lodge a complaint with the Irish Data Protection Commission (www.dataprotection.ie) or any other competent supervisory authority.
2. Communication via Social Media Pages
We also process information that you provide to us via our LinkedIn company page such as your username, contact details, or messages. We process this data as the sole controller based on our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR). Further processing may occur if you have given your consent (Art. 6(1)(a) GDPR) or if it is necessary to comply with a legal obligation (Art. 6(1)(c) GDPR).
IV. Further Data Processing
1. Job Applications
When you apply to our company, we process your application data exclusively for purposes related to your interest in current or future employment with us and the processing of your application. Your application will only be processed and reviewed by the relevant personnel within our company. All employees involved in data processing are bound by confidentiality obligations. If we are unable to offer you employment, we will retain the data you have provided for up to six months after any rejection for the purpose of answering questions regarding your application and its outcome. This does not apply if legal provisions prevent deletion, if further storage is necessary for evidentiary purposes or if you have expressly consented to longer storage. The legal basis for this is Section 26(1) sent. 1 BDSG or Art. 6(1)(b) GDPR. If we store your application data for longer than six months and you have expressly consented to this, we would like to point out that this consent can be freely withdrawn at any time in accordance with Art. 7(3) GDPR. Such withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
2. Contacting Us
If you call us or send us a message via the contact email address provided, we will process the data transmitted for the purpose of responding to your enquiry. We process this data based on our legitimate interest in contacting enquirers.
The legal basis for this processing is Art. 6(1)(f) GDPR.
3. Customer and Prospect Data
If you contact our company as a customer or interested party, we will process your data to the extent necessary to establish or implement the contractual relationship. This typically includes the processing of the personal data provided to us, such as master data, contract and payment details, as well as contact and communication data of our contact persons at commercial customers and business partners. The legal basis for this processing is Art. 6(1)(f) GDPR for commercial customers and Art. 6(1)(c) GDPR for end customers.
We also process customer and prospect data for evaluation and marketing purposes. This processing is carried out on the legal basis of Art. 6(1)(f) GDPR and serves our interest in further developing our offering and providing you with targeted information about our offerings.
Further data processing may take place if you have given your consent (Art. 6(1)(a) GDPR) or if this is necessary to fulfil a legal obligation (Art. 6(1)(c) GDPR).
4. Shareholders and Shareholder Representatives
In connection with the handling of Annual General Meetings, we process personal data, in particular the name, date of birth, address and other contact details of shareholders, number of shares, type of share ownership, access data for the access-protected AGM portal, IP address, and, if applicable, the name and address of authorized shareholder representatives. The personal data was provided to us by the shareholders and shareholder representatives when registering for the Annual General Meeting or, in the case of shareholders, by the custodian banks for this purpose. In order to enable shareholders to register for voting via the website, the processing of the voting card number as well as the access number of the voting shareholders is necessary. Providing an email address, however, remains optional.
The processing of this data is necessary to comply with the requirements of the German Stock Corporation Act (AktG), in particular to enable shareholders to participate in and exercise their rights before and during the Annual General Meeting (e.g. registration for the Annual General Meeting, dispatch of voting cards, documentation of eligibility to participate, creation of the list of participants). Furthermore, data processing is carried out for communication with custodian banks and shareholders.
The legal basis for processing your personal data is the German Stock Corporation Act in conjunction with Art. 6(1)(c) GDPR.
Status: [1.0, 23.09.2025]