Privacy Policy of HHL GLOBAL PROPERTY INVEST GmbH

We are pleased that you are visiting our website and thank you for your interest in our company. The protection of personal data is important to us. Therefore, the processing of personal data, such as the name, address, email address, or telephone number of a data subject, is carried out in accordance with applicable European and national law.

If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.

You can, of course, revoke your consent(s) at any time with future effect. Please contact the responsible party to do so. You can find the contact details at the bottom of this privacy policy.

HHL GLOBAL PROPERTY INVEST GmbH, hereinafter referred to as "HHL," would like to inform the public about the nature, scope, and purpose of the personal data it processes. Furthermore, this privacy policy informs data subjects about their rights.

Definitions
HHL's privacy policy is based on the terminology used by the European legislator for the adoption of the General Data Protection Regulation (hereinafter referred to as the "GDPR"). Our privacy policy is intended to be easily readable and understandable for the public, as well as for our guests and business partners. To ensure this, we would like to explain the terminology used in advance.

In this privacy policy and on our website we use, among other things, the following terms:

Personal data is all information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Affected person means any identified or identifiable natural person whose personal data is processed by the controller.

processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or linking, restriction, erasure or destruction.

Restriction of processing is the marking of stored personal data with the aim of restricting its future processing.

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Controller or person responsible for processing is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient "Recipient" means a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be considered recipients.

Third means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process the personal data.

consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data concerning him or her.

registration
The data subject has the option of registering on the controller's website by providing personal data. The personal data transmitted to the controller in this process is determined by the input mask used for registration. The personal data entered by the data subject are collected and stored exclusively for internal use by the controller and for its own purposes. The controller may arrange for the data to be transferred to one or more processors (e.g., a parcel service provider), who will also use the personal data exclusively for internal use attributable to the controller.

By registering on the website of the controller, the IP address assigned to the data subject by the Internet service provider (ISP), as well as the date and time of registration, are also stored. This data is stored because it is the only way to prevent misuse of our services and, if necessary, to enable the investigation of committed crimes and copyright infringements. Therefore, the storage of this data is necessary to protect the controller. As a general rule, this data will not be passed on to third parties unless there is a legal obligation to do so or the transfer serves the purposes of criminal prosecution or legal proceedings.

The registration of the data subject with the voluntary provision of personal data allows the controller to offer the data subject content or services that, due to the nature of the matter, can only be offered to registered users. Registered persons are free to have the personal data provided during registration completely deleted from the controller's database.

The controller shall provide each data subject with information, upon request, at any time about which personal data concerning the data subject is stored. Furthermore, the controller shall correct or delete personal data at the request or notification of the data subject, unless otherwise required by law.

contact
HHL also processes personal data if you provide it voluntarily. This happens, for example, every time you contact us. We will, of course, use the personal data transmitted in this way exclusively for the purpose for which you provided it when you contacted us. This information is provided expressly on a voluntary basis and with your consent. If this information relates to communication channels (e.g., email address, telephone number), you also consent to us contacting you via this communication channel if necessary to respond to your request.

Security
HHL takes numerous technical and organizational measures to protect your personal data against accidental or unlawful deletion, alteration or loss, as well as against unauthorized disclosure or access.

However, internet-based data transmissions, for example, may generally have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us via alternative means, such as by telephone.

Links to other websites
This website contains links to other websites (so-called external links).

As a provider, HHL is responsible for its own content in accordance with applicable European and national law. Links to content provided by other providers must be distinguished from this own content. We have no influence on whether the operators of other websites comply with applicable European and national legal provisions. Please inform yourself about this in the privacy statements provided on the respective website. HHL assumes no responsibility for third-party content made available via links and specifically marked, and does not adopt this content as its own. The provider of the website to which reference is made is solely liable for illegal, incorrect, or incomplete content, as well as for damages resulting from the use or non-use of the information.

Cookies
We use cookies to make our website user-friendly and optimally tailored to your needs. Cookies are small text files that are sent from a web server to your browser when you visit a website and stored locally on your device (PC, notebook, tablet, smartphone, etc.).

Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a character string that websites and servers can use to associate the specific web browser in which the cookie was stored. This enables visited websites and servers to distinguish the individual browser of the data subject from other web browsers that contain other cookies. A specific web browser can be recognized and identified via the unique cookie ID. This information is used to automatically recognize you when you visit the website again using the same device and to make navigation easier for you.

You can consent to or reject cookies – including those for web tracking – using your web browser settings. You can configure your browser to refuse cookies altogether or to inform you in advance when a cookie is about to be saved. In this case, however, the functionality of the website may be impaired (for example, when placing orders). Your browser also offers a function for deleting cookies (for example, via "Delete browsing data"). This is possible in all common web browsers. Further information on this can be found in the user manual or in your browser settings.

Collection of general data and information
The HHL website collects a series of general data and information each time the website is accessed by a data subject or an automated system. This general data and information is stored in the server's log files. The following may be collected:
· the browser types and versions used
· the operating system used by the accessing system
· the website from which an accessing system reaches our website (so-called referrer)
· the sub-websites that are accessed via an accessing system on our website
· the date and time of access to the website
a web protocol address (IP address)
· the Internet service provider of the accessing system
· other similar data and information used to avert threats in the event of attacks on our information technology systems

When using this general data and information, HHL does not draw any conclusions about the data subject. Rather, this information is needed to:
· to deliver the contents of our website correctly
· to optimise the content of our website and the advertising for it
· to ensure the continued functionality of our information technology systems and the technology of our website
· To provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack

HHL therefore evaluates this anonymously collected data and information both statistically and with the aim of increasing data protection and data security within our company in order to ultimately ensure an optimal level of protection for the personal data we process. The anonymous data in the server log files are stored separately from all personal data provided by a data subject.

Routine deletion and blocking of personal data
The controller shall process (in this sense also: store) the personal data of the data subject only for the period necessary to achieve the purpose of storage or as far as this is provided for by the European legislator or other legislator in laws or regulations to which the controller is subject.

If the storage purpose no longer applies or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.

Rights of the data subject
Right to confirmation: Every data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him or her are being processed. If a data subject wishes to exercise this right of confirmation, they may contact the controller at any time.

Right to information: Any person affected by the processing of personal data has the right to obtain from the controller, free of charge, information about the personal data stored about him or her at any time, as well as a copy of this information. Furthermore, the European legislator has granted the data subject the right to access the following information:
· the purposes of processing
the categories of personal data being processed
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
where possible, the envisaged period for which the personal data will be stored, or, where not possible, the criteria used to determine that period
the existence of a right to rectification or erasure of personal data concerning them or to restriction of processing by the controller or a right to object to such processing
· the existence of a right of appeal to a supervisory authority
if the personal data are not collected from the data subject: all available information about the origin of the data
the existence of automated decision-making, including profiling, pursuant to Article 22 (1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject

Furthermore, the data subject has the right to information as to whether personal data has been transferred to a third country or to an international organization. Where this is the case, the data subject also has the right to receive information about the appropriate safeguards related to the transfer.

If a data subject wishes to exercise this right to information, he or she may contact the controller at any time.

Right to rectification: Any person affected by the processing of personal data has the right to request the immediate rectification of inaccurate personal data concerning him or her. Furthermore, taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data, including by means of providing a supplementary statement.

If a data subject wishes to exercise this right to rectification, he or she may contact the controller at any time.

Right to erasure (right to be forgotten): Any person affected by the processing of personal data has the right to request the controller to delete the personal data concerning him or her without undue delay, provided that one of the following reasons applies and the processing is not necessary:

The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
The data subject withdraws his or her consent on which the processing is based according to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, and there is no other legal ground for the processing.
The data subject objects to the processing pursuant to Art. 21 (1) EU GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 (2) EU GDPR.
· The personal data were processed unlawfully.
· The erasure of personal data is necessary to fulfil a legal obligation under Union or Member State law to which the controller is subject.
The personal data were collected in relation to information society services offered in accordance with Art. 8 (1) EU GDPR.

If one of the above reasons applies, and a data subject wishes to request the deletion of personal data stored by HHL, they may contact the controller at any time. The data subject's deletion request will then be complied with immediately.

If the personal data has been made public by HHL and our company, as the controller pursuant to Art. 17 (1) of the EU GDPR, is obliged to delete the personal data, HHL shall take appropriate measures, including technical ones, taking into account the available technology and the implementation costs, to inform other data controllers that process the published personal data that the data subject has requested the deletion of all links to these personal data or of copies or replications of these personal data from these other data controllers, unless processing is required. The controller will then arrange the necessary measures in individual cases.

Right to restriction of processing: Any person affected by the processing of personal data has the right to request the controller to restrict processing if one of the following conditions applies:

The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful, the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them to assert, exercise or defend legal claims.
The data subject has objected to processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.

If one of the above-mentioned conditions is met and a data subject wishes to request the restriction of personal data stored by HHL, they may contact the controller at any time. The restriction of processing will then be initiated immediately.

Right to data portability: Any person affected by the processing of personal data has the right to receive the personal data concerning him or her, which was made available to a controller, in a structured, common and machine-readable format. He or she also has the right to transmit this data to another controller without hindrance from the controller to whom the personal data was made available, provided that the processing is based on consent pursuant to point (a) of Article 6 (1) of the GDPR or point (a) of Article 9 (2) of the GDPR or on a contract pursuant to point (b) of Article 6 (1) of the GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising his or her right to data portability pursuant to Article 20(1) of the GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.

To assert the right to data portability, the data subject may contact the controller at any time.

Right to object: Any person affected by the processing of personal data has the right to object at any time, for reasons related to their particular situation, to the processing of personal data concerning them based on Article 6 (1) (e) or (f) of the GDPR. This also applies to profiling based on these provisions.

In the event of an objection, HHL will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

If HHL processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for such advertising purposes. This also applies to profiling insofar as it is related to such direct marketing. If the data subject objects to HHL processing for direct marketing purposes, HHL will no longer process the personal data for these purposes.

In addition, the data subject has the right to object, for reasons related to his or her particular situation, to the processing of personal data concerning him or her which is carried out by HHL for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) EU GDPR, unless such processing is necessary to perform a task carried out in the public interest.

To exercise the right to object, the data subject may contact the controller directly. Furthermore, in the context of the use of information society services, the data subject is free to exercise his or her right of objection by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC.

Automated decisions in individual cases, including profiling: Any person affected by the processing of personal data has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, provided that the decision:

is not necessary for the conclusion or performance of a contract between the data subject and the controller or
is permitted by Union or Member State law to which the controller is subject and which contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, or
· with the express consent of the data subject.

If the decision is necessary for the conclusion or performance of a contract between the data subject and the controller, or is made with the data subject’s explicit consent, HHL shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

If the data subject wishes to exercise rights with regard to automated decisions, he or she may contact the controller at any time.

Right to withdraw consent to data protection: Any person affected by the processing of personal data has the right to withdraw consent to the processing of personal data at any time.

If the data subject wishes to exercise his or her right to withdraw consent, he or she may contact the controller at any time.

Data protection in applications and during the application process
The controller collects and processes the personal data of applicants for the purpose of processing the application procedure. Processing may also be carried out electronically. This is particularly the case if an applicant submits corresponding application documents to the controller electronically, for example by email. If the controller concludes an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents will be automatically deleted six months after notification of the rejection decision, provided that no other legitimate interests of the controller conflict with deletion. Other legitimate interests in this sense include, for example, the burden of proof in proceedings under the General Equal Treatment Act (AGG).

etracker
This website uses technologies from etracker GmbH (www.etracker.com) to collect and store data for marketing and optimization purposes. User profiles can be created from this data under a pseudonym. Cookies may be used for this purpose. Cookies are small text files that are stored locally in the cache of the website visitor's internet browser. The cookies enable the internet browser to be recognized. The data collected using etracker technologies will not be used to personally identify the visitor to this website without the express consent of the data subject and will not be merged with personal data about the bearer of the pseudonym. The collection and storage of data can be revoked at any time with future effect.

Data protection provisions regarding the application and use of Google Analytics (with anonymization function)
This website uses Google Analytics, a web analytics service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). This service uses "Universal Analytics." This makes it possible to assign data, sessions, and interactions across multiple devices to a pseudonymous user ID, allowing for cross-device analysis of user activities. This privacy policy is provided by www.intersoft-consulting.de.

Google Analytics uses so-called "cookies", text files that are stored on your computer and that enable an analysis of your use of the website. The information about your use of the website generated by the cookie is usually transferred to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. Our legitimate interest in data processing also lies in these purposes. The legal basis for the use of Google Analytics is Section 15 (3) of the German Telemedia Act (TMG) and Article 6 (1) (f) of the GDPR. Sessions and campaigns are terminated after a certain period of time. By default, sessions are terminated after 30 minutes of inactivity, and campaigns after six months. The maximum time limit for campaigns is two years. Further information on terms of use and data protection can be found at https://www.google.com/analytics/terms/de.html or at https://policies.google.com/?hl=de.

You can prevent cookies from being saved by selecting the appropriate settings on your browser; however, please note that if you do this, you may not be able to use the full functionality of this website. Furthermore, you can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser add-on. Opt-out cookies prevent your data from being collected in the future when you visit this website. To prevent Universal Analytics from tracking your data across devices, you must opt out on all systems you use. If you click here, the opt-out cookie will be set: Deactivate Google Analytics
(Source: https://www.datenschutzanwalt-info.de/ )

Use of Facebook social plugins
Our website uses so-called social plugins ("plugins") from the social network Facebook, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). The plugins are marked with a Facebook logo or the addition "Facebook Social Plugin" or "Facebook Social Plugin." An overview of Facebook plugins and their appearance can be found here: https://developers.facebook.com/docs/plugins

When you visit a page on our website that contains such a plugin, your browser establishes a direct connection to the Facebook servers. The content of the plugin is transmitted directly from Facebook to your browser and integrated into the page. Through this integration, Facebook receives the information that your browser has accessed the corresponding page of our website, even if you do not have a Facebook profile or are not currently logged into Facebook. This information (including your IP address) is transmitted from your browser directly to a Facebook server in the USA and stored there.

If you are logged in to Facebook, Facebook can directly associate your visit to our website with your Facebook profile. If you interact with the plug-ins, for example, by clicking the "Like" button or leaving a comment, this information is also transmitted directly to a Facebook server and stored there. The information is also published on your Facebook profile and displayed to your Facebook friends.

For information on the purpose and scope of data collection and further processing and use of data by Facebook, as well as your rights and settings options for protecting your privacy, please refer to Facebook's privacy policy: http://www.facebook.com/policy.php

If you do not want Facebook to directly associate the data collected through our website with your Facebook profile, you must log out of Facebook before visiting our website. You can also completely prevent the Facebook plug-in from loading using add-ons for your browser, such as the "Facebook Blocker" (http://webgraph.com/resources/facebookblocker/).

Use of Google Maps
This website uses Google Maps to display maps and create directions. Google Maps is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. By using this website, you consent to the collection, processing, and use of automatically collected data and data you enter by Google, one of its agents, or third parties. The terms of use for Google Maps can be found under the Google Maps Terms of Use.

Name and address of the person responsible:
The controller within the meaning of the EU General Data Protection Regulation (EU GDPR), other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is:

HHL GLOBAL PROPERTY INVEST GmbH
High Bleaching 8
20354 Hamburg
Tel.: +49 (0)40 – 555536-212
Fax: +49 (0)40 – 555536-25​
Managing Director:
Daniel Weber
Stavros Lalos
Hamburg District Court:
HRB 150831
Tax number: 48/731/04797
VAT ID No.: DE320955894
To send an email, please replace (a) with @. This notation is used to prevent spam.

Changes to the Privacy Policy
We reserve the right to modify our privacy practices and this Policy to reflect changes in applicable laws or regulations or to better meet your needs. We will post any changes to our privacy practices here. Please check the most recent version of this Privacy Policy for updates.

Hamburg, September 2019