Privacy Policy

HIH Real Estate GmbH welcomes you to our internet site. We are delighted about your interest in our company and would like to make your visit to our websites as pleasant as possible. For us, it goes without saying that we will handle your data responsibly and in full compliance in every respect with the legal requirements in Germany. In the following statement, we will explain how we process your personal data and provide you with additional information relevant in this context.

1. Scope of application

This privacy information applies to the following internet sites and their related sub-domains: www.hih.de, www.hih-gruppe.de.

2. Who is responsible for the processing of your personal data?

HIH Real Estate GmbH, Gertrudenstraße 9, 20095 Hamburg (hereinafter referred to as “we”) is the controller in the sense of the EU General Data Protection Regulation (“GDPR”).

3. Data protection officer

Whenever you have any questions concerning the processing of your personal data and the exercise of your rights pursuant to the GDPR, you may contact our external data protection officer, Mr Ben R. Hansen (BHansen[at]hih.de), for advice or our data protection team at datenschutz[at]hih.de.

4. For what purposes and on what legal grounds do we process personal data?

a. Surfing on our website

We collect data about every server access related to our sites (so-called server log files). These data are used for the administration and optimisation of the internet sites and for statistical purposes.

Our website also uses cookies. Cookies are small text files that your web browser stores on your device. Cookies help us to make our sites more user friendly, more effective and more secure.

Some cookies are known as “session cookies”. Cookies of this type are deleted automatically at the end of your browser session. Other types of cookies, however, remain on your device until you delete them yourself. These types of cookies help us to recognise you when you pay a return visit to our website.

You can change the settings on the internet browser you use to prevent the placement of cookies. Some browsers permit the placement of cookies as their default settings. If you do not wish to allow this, you can change the settings of your browser. Please see the instructions from the manufacturer of your browser to see how this is done. Disabling cookies can result in limitations on the functions available on our website.

The placement of cookies that are required for the performance of electronic communications processes or for the provision of certain functions you wish to have is based on point (f) of Art. 6 (1) GDPR. As the operators of this website, we have a legitimate interest in the placement of cookies to ensure technically error-free and frictionless provision of our services.

We also use Google Analytics for evaluation of the ways our visitors use our sites. Google processes the information collected here on our behalf for the evaluation of your use of our website and compiles reports about activities within this website. The processed data may be used to create pseudonym use profiles of the users.

The analysis of cookies is done in pursuit of our interest in an attractive presentation of our online services. This represents a legitimate interest within the sense of point (f) of Art. 6 (1) GDPR.

You will find details about Google Analytics’ handling of user data and how you can object to the collection of your data in point (c) of Section 6 of this privacy statement.

Cookie consent with Borlabs Cookie

Our website uses the cookie consent technology from Borlabs Cookie to obtain your consent to store certain cookies in your browser and to document these in accordance with data protection regulations. This technology is provided by Borlabs – Benjamin A. Bornschein, Georg-Wilhelm-Strasse 17, 21107 Hamburg (hereinafter referred to as Borlabs).

When you access our website, a Borlabs cookie is stored in your browser, in which the permissions you have granted or revocations of these permissions are stored. These data are not forwarded to the providers of Borlabs Cookie.

The data recorded are stored until you request that we delete these or the Borlabs cookies delete themselves or until the purpose of the data storage ceases to apply. This does not affect mandatory statutory retention periods. You can find details on data processing by Borlabs Cookie at https://borlabs.io/kb/what-information-does-borlabs-cookie-store/

The Borlabs cookie consent technology is used to obtain permission for the use of cookies required by law. The legal basis for this is Article 6 (1) sentence 1 (c) GDPR.

b. Contacting us and communications

Some of the sections of the sites offer you the opportunity to enter personal data in entry fields for the purpose of establishing correspondence with us. These data are processed solely for the purpose you intended in providing the data to us, e.g. processing your queries and, at your request, contacting you.

In this case, processing of the personal data is done with your consent and is consequently lawful pursuant to point (a) of Art. 6 (1) GDPR.

5. What categories of personal data do we process?

a. Surfing on our website

Server log files

Server log files are automatically sent from your browser to us and stored. They comprise the following data and help optimise our website and ensure it is displayed correctly:

Browser type and version
Operating system used
Referrer URL
Host name of the accessing computer
Time of server request
IP address

These data are not merged with other data sources.

These data are collected on the basis of Article 6 (1) (f) GDPR.

b. Contacting us and communications

We process data that are related to your contact request. These are general data about you personally (such as name, address and contact information) and any additional information that you send to us as part of your contact request.

Contact form

If you send us inquiries using the contact form, we store your data from the inquiry form, including the contact details you provide there, in order to process the inquiry and for any follow-up questions. We do not pass on these data without your permission.

If your inquiry is related to the fulfilment of a contract or pre-contractual measures, these data are processed on the basis of Article 6 (1) (b) GDPR. In all other cases, they are processed on the basis of our legitimate interest in efficiently processing inquiries addressed to us (Article 6 (1) (f) GDPR) or on the basis of your consent (Article 6 (1) (a) GDPR), where this was requested.

We retain the data you provide in the contact form until you request that we delete these, revoke your consent for the storage or the reason for storing the data ceases to apply (e.g. once your inquiry has been processed). This does not affect mandatory statutory terms, in particular retention periods.

c. E-mail, phone or fax inquiry

If you contact us by e-mail, phone or fax, we will store and process your inquiry, including all personal data associated with this (name, inquiry), in order to handle your request. We do not pass on these data without your permission.

We retain the data you send us in your contact inquiry until you request that we delete these, revoke your consent for the storage or the reason for storing the data ceases to apply (e.g. once your request has been processed). This does not affect mandatory statutory terms, in particular statutory retention periods.

6. What categories of recipients are there?

If you send to us a contract request, your personal data may be transferred to the companies affiliated with us shown in the list below insofar as this is permissible within the scope of the purposes and legal grounds described in Section 4:

easol GmbH
HIH Real Estate GmbH
HIH Institutional Advisory GmbH
HIH Property Management GmbH
HIH Business Development GmbH
HIH Projektentwicklung GmbH
IntReal International Real Estate Kapitalverwaltungsgesellschaft mbH
IntReal Solutions GmbH
IntReal Legal Advisory GmbH
Real Exchange AG
HIH Invest Real Estate GmbH

In addition, contents from third-party providers such as videos on YouTube and map material from Google Maps have been integrated into our websites. These applications are hosted on the partners’ servers and are operated by these partners. Please note that the use of such applications is governed by the privacy policies published on these sites of the partners operating the applications and that these partners are the controllers of the processing in the sense of Art. 4 (7) GDPR.

a. YouTube

This website uses embedded YouTube videos. The website is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube’s expanded data protection mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch the video. However, the expanded data protection mode does not necessarily prevent data being sent on to YouTube partners. Accordingly, YouTube establishes a connection to the Google DoubleClick network regardless of whether or not you watch a video. As soon as you start a YouTube video on this website, a connection is established to the YouTube servers. This notifies the YouTube server of which of our pages you have visited. If you are logged in to your YouTube account, YouTube can directly associate your browsing habits with your personal profile. You can prevent this by logging out of your YouTube account.

After starting a video, YouTube can also store various cookies on your device. Using these cookies, YouTube can obtain information on visitors to this website. This information is used in part to compile video statistics, improve user-friendliness and prevent fraud. The cookies remain stored on your device until you delete them.

After starting a YouTube video, other data processing activities may be initiated over which we have no control.

YouTube is used to display our online services in an attractive way. This constitutes legitimate interest within the meaning of Article 6 (1) (f) GDPR. If corresponding permission is requested, data is processed exclusively on the basis of Article 6 (1) (a) GDPR; permission can be revoked at any time.

You can find further information on data protection at YouTube in its Privacy Policy at https://policies.google.com/privacy?hl=en-GB.

b. Google Maps

This website uses Google Maps via an API. This is provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Using the Google Maps functions requires storing your IP address. This information is usually sent to a Google server in the USA, where it is then stored. The provider of this website cannot influence this data transfer.

Google Maps is used to display our online services in an attractive way and to make it easy to locate the places specified by us on the website. This constitutes legitimate interest within the meaning of Article 6 (1) (f) GDPR. If corresponding permission is requested, data is processed exclusively on the basis of Article 6 (1) (a) GDPR; permission can be revoked at any time. You can find more information on how user data is handled in Google’s Privacy Policy at https://policies.google.com/privacy?hl=en-GB.

c. Google Analytics

This website uses functions of the web analytics service Google Analytics. This is provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies. Cookies are text files stored on your computer that can be used to analyse your use of the website. The information created by the cookie regarding your use of this website is usually sent to a Google server in the USA, where it is then stored.

The basis for storing these Google Analytics cookies and using this analysis tool is Article 6 (1) (f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its web content and its advertising. If corresponding permission is requested (e.g. permission to store cookies), data is processed exclusively on the basis of Article 6 (1) (a) GDPR; permission can be revoked at any time.

IP anonymisation

We have activated the IP anonymisation function on this website. This means that Google shortens your IP address within Member States of the European Union or contracting parties to the Agreement on the European Economic Area before it is sent to the US. Only in exceptional cases is the full IP address sent to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, create reports on website activities and provide additional services associated with website use and internet use for the website operator. The IP address sent from your browser as part of Google Analytics is not merged with other data from Google.

Browser plugin

You can block the storage of cookies by selecting the appropriate settings in your browser software. However, please note that this may prevent you from using all functions of this website in full. You can also prevent the data created by the cookie and related to your use of the website (including your IP address) from being sent to or processed by Google by downloading and installing the browser plugin at https://tools.google.com/dlpage/gaoptout?hl=en-GB.

Object to data collection

You can prevent Google Analytics collecting your data by clicking in the following link. This stores an opt-out cookie that prevents your data being collected when you visit this website in future:

Deactivate Google Analytics.

You can find more information on how Google Analytics handles user data in Google’s Privacy Policy at https://policies.google.com/privacy?hl=en-GB.

Order processing

We have entered into an order processing agreement with Google and apply the German data protection authorities’ strict specifications in full when using Google Analytics.

Storage period

Data stored by Google at user and event level that are linked with cookies, user information (e.g. user ID) or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) are anonymised or deleted after 14 months. You can find details on this at https://support.google.com/analytics/answer/7667196?hl=en

d. Adobe Fonts

This website uses certain Adobe web fonts to ensure a standardised display. These are provided by Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (Adobe).

When you visit this website, your browser automatically loads the required fonts directly from Adobe so that these can be correctly displayed to your device. This involves your browser establishing a connection to Adobe’s servers in the USA. This informs Adobe that this website was accessed via your IP address. According to Adobe, no cookies are stored when providing the fonts.

Adobe relies on standard contractual clauses or adequacy decisions of the European Commission on specific countries. The data processing agreement prepared by Adobe contains the standard contractual clauses. Source: https://www.adobe.com/de/privacy/eudatatransfers.html

The data are stored and analysed on the basis of Article 6 (1) (f) GDPR. The website operator has a legitimate interest in ensuring the typeface used on its website is standardised. If corresponding permission is requested (e.g. permission to store cookies), data is processed exclusively on the basis of Article 6 (1) (a) GDPR; permission can be revoked at any time.

You can find more information on Adobe Fonts at https://www.adobe.com/privacy/policies/adobe-fonts.html.

Adobe’s Privacy Policy can be accessed at https://www.adobe.com/privacy/policy.html

7. How long are your data stored?

a. Surfing on our website

“Session cookies” are deleted automatically at the end of your browser session. Other types of cookies, however, remain on your device until you delete them yourself.

The personal data collected by Google Analytics are either erased or anonymised after 14 months.

b. Contacting us and communications

We erase your data in this context when the purpose for which you have given us the data has been fulfilled or completed and we are not entitled or obligated to continue to store the data by legal regulations.

8. What rights do you have?

You have the following rights with regard to the personal data concerning you:

a. Information and access

You have the right to obtain information about your personal data we have processed and to request access to your personal data and/or copies of these data. This includes information about the purpose of the use, the category of the data used, the recipients of the data and the parties authorised to access the data and, if possible, the envisaged period of the data storage or, if this is not possible, the criteria for determining this period.

b. Rectification

You have the right to request from us the rectification without undue delay of any inaccurate personal data concerning you. You have the right to request the completion of any incomplete personal data — including by means of providing a supplementary statement — taking into account the purposes of the processing.

c. Right to object

Insofar as the processing of personal data concerning you is based on point (f) of Art. 6 (1) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of these data. We will no longer process these personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims. You will find more information about your right to object with respect to our third-party providers under Section 6.

Right to object to data collection in specific cases and to direct marketing (Article 21 GDPR)

FOR DATA PROCESSING ON THE BASIS OF ARTICLE 6 (1) (E) OR (F) GDPR, YOU ARE ENTITLED TO OBJECT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA, INCLUDING PROFILING BASED ON THESE PROVISIONS. PLEASE SEE THIS DATA PROTECTION POLICY FOR THE LEGAL BASIS OF PROCESSING. IF YOU LODGE AN OBJECTION, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA IN QUESTION UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS OR FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21 (1) GDPR).

IF YOUR PERSONAL DATA ARE PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING, WHICH INCLUDES PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (OBJECTION PURSUANT TO ARTICLE 21 (2) GDPR).

d. Right to withdraw consent

If the processing is based on your consent, you have the right to withdraw the consent at any time without prejudice to the lawfulness of the processing based on the consent prior to the withdrawal.

e. Right to erasure

You have the right to obtain from us the erasure of personal data concerning you without undue delay, and we have the obligation to erase these personal data without undue delay where one of the following grounds applies:

The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
You object to the processing in accordance with point (c) of Section 8 above and there are no overriding legitimate reasons for the processing;
The personal data have been unlawfully processed;
The personal data must be erased in compliance with a legal obligation in EU law or member state law to which we are subject.

The above provisions do not apply if and when the processing is necessary:

For the fulfilment of a legal obligation that requires the processing in accordance with EU law or member state law to which we are subject;
For the establishment, exercise, or defence of legal claims.

f. Right to restriction of processing

You have the right to request from us the restriction of processing if one of the following prerequisites has been met:

You contest the accuracy of the personal data; the processing is restricted pending our verification of the accuracy of the personal data;
The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
We no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
You have objected to the processing pursuant to point (c) of Section 8 above; the processing is restricted pending verification of whether our legitimate interests override yours.

Where processing has been restricted on the basis of the aforementioned conditions, these personal data may, with the exception of storage, be processed solely with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state.

If you have obtained restriction of the processing, we will notify you before the restriction is lifted.

g. Right to data portability

You have the right to receive from us your personal data in machine-readable format if the processing was based on your consent or a contract and was performed automatically.

SSL/TLS encryption

This website uses SSL/TLS encryption for reasons of security and to protect confidential information such as orders or inquiries that you send to us as the website operator. You can check you have an encrypted connection by looking to see if the address line in your browser has changed from “http://” to “https://” and looking for the padlock symbol in your browser toolbar.

When SSL/TLS encryption is activated, data you send to us cannot be read by third parties.

h. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. You will find a list of the data protection supervisory authorities, including data protection officers and their contact data, at the following link:https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

The exercise of these rights is free of charge for you. You will find our contact data in Section 3 of this privacy statement.

9. Requirement to provide personal data

The provision of personal data is required neither by law nor by contract, nor are you obligated to provide the personal data. However, the provision of personal data is necessary to establish contact with us. Moreover, we cannot guarantee that you will be able to utilise all the functions of this website without restriction if your browser blocks cookies.

10. Update of this data protection information

It may be necessary to update this data protection information from time to time, e.g. because of new services or products on our internet site or in compliance with legal changes. You will find the most recent version here. In general, we recommend that you retrieve this data protection information at regular intervals to see if there have been any changes. You can determine this by checking the date of the most recent revision displayed at the end of this document or by other means.

11. Miscellaneous

You can print out and save this data protection information directly, e.g. by using the print or save function in your browser.

This data protection information was prepared on 18 May 2018. It was most recently revised on 18 February 2021.