Privacy Policy

UNIVERS Capital GmbH Privacy Policy

§ 1 General Information on the Structure of Our Website and the Privacy Policy
The following general information explains the structure of the website and the organization of the operator. It applies regardless of where you are on our website and which features you use. To provide you with the clearest possible overview of where we process which of your personal data, you will find links to three additional subpages above this text. There you will find information about the respective data processing that occurs when you visit our website, after registering on this internet platform, and information regarding the handling of your data as part of a job application process. UNIVERS Capital GmbH, headquartered in Berlin, with its place of business at Grolmanstr. 36, 10623 Berlin (hereinafter also referred to as “UNIVERS Capital”), is the owner of the technical internet platform “www.universcapital.de” (hereinafter also referred to as the “Platform”) and operates it as a technical service provider. In addition, UNIVERS Capital makes the Platform available to various providers (real estate companies), who use this Platform to directly market their respective products. The Platform enables visitors to access information provided by the providers regarding real estate projects, securities, and special AIFs and—after registering as a user—to purchase securities, special AIFs, or other investment products directly from the respective providers. As soon as a visit to the site goes beyond mere viewing and an interaction with the visitor takes place—for example, when the visitor clicks on the “Register” or “Customer Portal” fields—the visitor leaves the “UNIVERS Capital GmbH” homepage and enters the area of the platform managed by the respective real estate companies. The type, amount, and purpose of the processing of personal data, as well as the identity of the data controller, may vary depending on which part of the website you are visiting.

The operators of these pages take the protection of your personal data very seriously. Your data will be treated confidentially and in accordance with the applicable legal data protection regulations and this Privacy Policy.

§ 2 Data Protection on the Website
When you visit this website, various types of personal data are processed. Personal data is information that can be used to personally identify you. This Privacy Policy explains what data we collect and how we use it. It also explains how and for what purpose this is done. To the extent that we have received personal data from you through other channels (e.g., via email), the following Privacy Policy also applies. Please note that data transmission over the Internet (e.g., when communicating via email) may involve security vulnerabilities. It is not possible to completely protect data from access by third parties.

If you have any questions about this privacy policy or the processing of your personal data, please contact the following responsible entity:

Information on the Responsible Entity

UNIVERS Capital GmbH

Grolmanstraße 36, 10623 Berlin, Germany

Technical Support: +49 (0) 30 – 810 56 61 18

Email: datenschutz@universcapital.de

– hereinafter also “UNIVERS Capital GmbH”

Data processing on this website is carried out by the website operator. As the provider of this website, we are, on the one hand, the controller within the meaning of Article 4(7) of the GDPR and, on the other hand, a service provider within the meaning of Section 2(1) of the TTDSG.

Legal Basis for Data Processing
Your personal data is processed exclusively i) based on your consent, ii) to fulfill a contractual relationship, iii) based on the controller’s legitimate interest in data processing, or iv) to fulfill a legal obligation or in the public interest.

Withdrawal of Your Consent to Data Processing
If data processing is based on your explicit consent, this consent may be withdrawn at any time without providing reasons and with future effect. To do so, simply send us an informal email. The lawfulness of the data processing carried out up to the time of withdrawal remains unaffected by the withdrawal.

Right to Object to Data Collection in Specific Cases and to Direct Marketing (Art. 21 GDPR)
If data processing is based on the controller’s legitimate interest in the data processing or on tasks carried out in the public interest that have been entrusted to the controller (Art. 6(1)(e) or (f) of the GDPR), you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this Privacy Policy. If you object, we will no longer process your personal data in question, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims (objection under Art. 21(1) of the GDPR).

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes (Objection pursuant to Art. 21(2) of the GDPR).

Data Subject Rights
Under applicable data protection laws, you have extensive rights regarding your data. You may exercise these rights by sending an email to datenschutz@universcapital.de. These rights include, in particular:

Right of Access
Upon request, UNIVERS Capital GmbH will provide you, within the legally prescribed timeframe, with comprehensive information regarding all data stored about you by UNIVERS Capital GmbH. In addition to the personal data itself, this information also includes the purpose of processing and the nature of the processing.

Right to Rectification
You have the right at any time to request that UNIVERS Capital GmbH correct, supplement, or amend your personal data. Under certain circumstances, UNIVERS Capital GmbH may require proof of your identity before it can comply with this request.

Right to Data Portability
You have the right, to the extent technically feasible, to have all data stored by UNIVERS Capital GmbH regarding you transferred to another company.

Right to Erasure
Upon your request, UNIVERS Capital GmbH will erase all personal data concerning you that is stored by UNIVERS Capital GmbH within the period prescribed by law. If a statutory retention obligation exists, the data will not be erased until this period has expired. This data will be blocked internally for further use.

Right to Restriction of Processing
You have the right to request the restriction of the processing of your personal data. The right to restriction of processing applies in the following cases:

(1) If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.

(2) If the processing of your personal data was or is unlawful, you may request the restriction of data processing instead of erasure.

(3) If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.

(4) If you have lodged an objection pursuant to Article 21(1) of the GDPR, a balancing of your interests against ours must be conducted. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data—apart from its storage—may be processed only with your consent, or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of a substantial public interest of the European Union or a Member State.

Right to lodge a complaint with the competent supervisory authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place where the alleged violation occurred. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Data Security

SSL or TLS Encryption
For security reasons and to protect the transmission of confidential content—such as orders or inquiries you send to us as the website operator—this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Encrypted Payment Transactions on This Website
If, after entering into a paid contract, you are required to provide us with your payment information (e.g., account number for direct debit authorization), this information is necessary for processing the payment.

Payment transactions using standard payment methods (direct debit) are conducted exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar.

With encrypted communication, the payment data you transmit to us cannot be read by third parties.

§ 3 Recording of Telephone Calls
Telephone calls between a real estate company advertising on the platform and a platform customer must be recorded in accordance with the requirements of the MiFID II Code of Conduct. This obligation to record and retain the recordings arises from Section 83(3) of the German Securities Trading Act (WpHG) as a specification of Delegated Regulation (EU) 2017/565 (DV) and the BaFin’s minimum requirements for risk management (MaRisk BTO 2.2.1 (para. 4)). Thus, data processing is carried out to fulfill legal obligations under Article 6(1)(c) of the GDPR.

The information regarding the controller and the rights of data subjects under Section 2 applies accordingly.

When recording telephone calls, we process not only the actual content of the conversation but also technical information from the telephone system, which is either generated there or provided by the telephone company. This includes the telephone numbers involved in the call, the start time of the call, and the duration of the call.

You should always expect calls to be recorded—even without prior notice—provided the call takes place within the business operations of the respective real estate company.

Within UNIVERS Capital GmbH, access to your data is granted only to those departments that require it to fulfill the purpose of processing or to meet legal requirements. To comply with legal requirements, employees, competent supervisory authorities, and auditors may access the recorded data.
In the event of legal disputes, we will hand over the recordings to attorneys and courts if we are legally required to do so or need to defend our own legal positions. In operating our telephone systems, we engage service providers who work strictly in accordance with our specifications and must meet statutory data protection standards (so-called “processors”) . These service providers do not process your data for any purposes other than those specified by us.

The retention period for the data is generally five or seven years in accordance with Section 83(8) of the German Securities Trading Act (WpHG). Should special circumstances arise that justify a legitimate interest on the part of UNIVERS Capital GmbH in retaining the records for a longer period, such retention shall not exceed ten years and two weeks. Upon expiration of this period, the data will be automatically deleted.

§ 4 Data Protection Officer

Legally Required Data Protection Officer

We have appointed an external data protection officer for UNIVERS Capital GmbH. You can contact the data protection officer at:

UNIVERS Capital GmbH

Data Protection Officer

Grolmanstraße 36, 10623 Berlin, Germany
Phone: +49 (0) 30 – 810 56 61 10
Email: datenschutz@universcapital.de

§ 5 Retention
Your data will be stored for as long as necessary to provide the services. If longer retention is required by law, the data will be stored until the expiration of that period.

§ 6 Copyright
The content of our website, in particular the products displayed and the data provided, is protected by copyright. The content may not be reproduced and/or published, in whole or in part, or stored in an information system without prior written permission. Displaying this website within third-party frames is permitted only with express written consent.

§ 7 Scope of the Privacy Policy
This Privacy Policy applies exclusively to the joint website of UNIVERS Capital.
This Privacy Policy does not apply to services offered by other companies or individuals, including products or websites displayed to you in search results, websites that may include services from UNIVERS Capital GmbH, or other websites linked to services from UNIVERS Capital GmbH. This Privacy Policy does not cover the handling of information by other companies or organizations that advertise services and may use cookies, pixel tags, and other technologies to provide and display relevant ads.

§ 8 Analytics Tools and Advertising
If cookies are used on our pages for analytics or advertising purposes, we will inform you of this via Usercentrics’ cookie consent technology. If the cookies used are not classified as essential, you have the option here to give or withdraw your consent.
You can find more information about the cookies currently in use and manage your consent via the fingerprint icon in the lower-left corner of our homepage.

§ 9 Changes
Updates to the content of this Privacy Policy may be necessary due to, among other things, organizational, legal, or regulatory changes. The most current version of the Privacy Policy will be published on this website.

§ 10 Newsletter

Newsletter Information
You can subscribe to the newsletter at any time, regardless of whether you are registered or not. If you wish to receive the newsletter, we will need your email address again, as well as information that allows us to verify that you are the owner of the provided email address and consent to receiving the newsletter, since this is a process independent of registration. No other data is collected, or is collected only on a voluntary basis. We use this data exclusively to send the requested information and do not share it with third parties.

The processing of the data entered in the newsletter sign-up form is based solely on your consent (Art. 6(1)(a) GDPR). You may revoke the consent you have given for the storage of your data and email address, as well as their use for sending the newsletter, at any time by emailing datenschutz@universcapital.de or by clicking the “Unsubscribe” link in the newsletter. The lawfulness of data processing operations that have already taken place remains unaffected by this revocation.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted after you unsubscribe. Data stored by us for other purposes remains unaffected by this.

Email Service Provider
The newsletter is distributed via the email service provider Braze [https://www.braze.com/]. You can view the email service provider’s privacy policy here: https://www.braze.com/company/legal/privacy/

The email service provider is engaged on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR and a data processing agreement pursuant to Art. 28(3), sentence 1 of the GDPR. Should a transfer of personal data to the U.S. take place, the email service provider must comply with the provisions of the standard contractual clauses pursuant to Art. 46 of the GDPR.

The shipping service provider’s use of the transferred personal data is carried out exclusively at the direction of UNIVERS Capital and in accordance with the data processing agreement. In addition, the shipping service provider is entitled to use the transmitted data in pseudonymous form—i.e., without linking it to a specific user—to optimize or improve its own services, e.g., for the technical optimization of newsletter delivery and presentation, or for statistical purposes.

Performance Measurement (iGoDigital)
The newsletters contain a so-called “web beacon,” i.e., a pixel-sized file that is retrieved from our server—or, if we use a mailing service provider, from its server—when the newsletter is opened. As part of this retrieval, technical information—such as details about your browser and system—as well as your IP address and the time of retrieval are collected.

This information is used to technically improve our services based on the technical data, or to analyze target groups and their reading behavior based on their access locations (which can be determined using the IP address) or access times. Statistical analysis also includes determining whether newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be traced back to individual newsletter recipients. However, it is neither our intention nor—if used—that of the mailing service provider to monitor individual users. Rather, the analyses help us identify our users’ reading habits and tailor our content to them, or send different content based on our users’ interests.

Unfortunately, it is not possible to opt out of performance tracking separately; in this case, the entire newsletter subscription must be canceled. Among other things, the iGoDigital cookie is used for this purpose on our website.

§ 11 Plugins and Tools

Google Tag Manager
Google Tag Manager is a solution that allows us to manage so-called website tags via a single interface (and thus, for example, integrate Google Analytics and other Google marketing services into our online offering). The Tag Manager itself (which implements the tags) does not process any personal data of users. With regard to the processing of users’ personal data, please refer to the following information about Google’s services. Terms of Service: https://www.google.com/intl/de/tagmanager/use-policy.html

Google Web Fonts
This site uses so-called web fonts provided by Google to ensure consistent font display. When you visit a page, your browser loads the required web fonts into its cache in order to display text and fonts correctly.
For this purpose, the browser you are using must establish a connection to Google’s servers. As a result, Google becomes aware that our website has been accessed via your IP address. The use of Google Web Fonts is intended to ensure a consistent, appealing, and, above all, understandable presentation of our online content. Ensuring the clarity and consistent, device-independent readability of our content is necessary for the effective conclusion of a contract and is therefore required under Article 6(1)(b) of the GDPR.

If your browser does not support Web Fonts, a standard font from your computer will be used.
For more information about Google Web Fonts, please visit https://developers.google.com/fonts/faq and consult Google’s Privacy Policy: https://policies.google.com/privacy?hl=de

Zenloop
To optimize our website and our products, we ask that you rate us. We use the so-called Net Promoter Score, or NPS for short.

This serves to protect our legitimate interests—as determined through a balancing of interests—in the optimal marketing of our offerings in accordance with Art. 6(1)(f) of the GDPR. The NPS and the services promoted through it are provided by zenloop GmbH, Brunnenstraße 196, 10119 Berlin.

When you submit a review, the web server automatically stores a so-called server log file that contains, for example, your IP address, the date and time of the request, the amount of data transferred, and the requesting provider (access data), and documents the request. This access data is not analyzed and is automatically overwritten no later than seven days after the end of your visit to the site.

Salesforce
We use the CRM system provided by salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, to process user inquiries more quickly and efficiently (legitimate interest pursuant to Art. 6(1)(f) of the GDPR).

Salesforce uses user data solely for the technical processing of inquiries and does not share it with third parties. To use Salesforce, you must provide at least a valid email address. Pseudonymous use is possible. During the processing of service inquiries, it may be necessary to collect additional data (name, address).

If users do not consent to data collection and storage in Salesforce’s external system, we offer them alternative contact options for submitting service requests via email, telephone, fax, or mail.

Users can find further information in Salesforce’s Privacy Policy: https://www.salesforce.com/de/company/privacy/

§ 12 Other Service Providers

Trustpilot A/S
The respective real estate companies advertising on the platform may contact platform users via email to invite them to rate their services and/or products so that these can be further optimized (the “Purpose”) . Since we collaborate with an external company, Trustpilot A/S (“Trustpilot”), to collect customer feedback, users’ names, email addresses, and reference numbers are shared with Trustpilot for this purpose. Users who would like to learn more about how Trustpilot processes their data can view the company’s privacy policy here. The real estate companies advertising on the platform may also use such reviews in other advertising media and materials for promotional and sales-promoting purposes.

§ 13 Data Processing When Visiting Our Website
As soon as you click on our website, we will process your personal data via cookies. Initially, only your IP address is processed, to the extent necessary for the operation of our website. Upon your first visit, a cookie banner will open in accordance with the provisions of § 25 TTDSG, which allows you to select the scope of further processing by choosing specific cookie types. You can change this selection at any time in the cookie settings.

Responsibility
UNIVERS Capital GmbH is responsible for the processing of cookies during your visit to our website.

Cookies
Some web pages use so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies serve to make our website more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser.

There are three categories of cookies:

– Essential cookies necessary to ensure the website’s basic functions.
– Functional cookies to ensure the website’s performance.
– Marketing cookies to display ads relevant to your interests

Most of the cookies we use are so-called “session cookies.” They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser on your next visit. Only device and browser data are stored for this purpose.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Cookie Consent with Usercentrics
This website uses Usercentrics’ cookie consent technology to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies, and to document this in compliance with data protection regulations. The provider of this technology is Usercentrics GmbH, Rosental 4, 80331 Munich, website: https://usercentrics.com/de/ (hereinafter “Usercentrics”).

When you visit our website, the following personal data is transmitted to Usercentrics:

– Your consent(s) or the revocation of your consent(s)
– Your IP address
– Information about your browser
– Information about your device
– The time of your visit to the website

Furthermore, Usercentrics stores a cookie in your browser to be able to associate the consents you have granted—or their revocation—with you. The data collected in this manner is stored until you request that we delete it, delete the Usercentrics cookie yourself, or the purpose for storing the data no longer applies. Mandatory legal retention requirements remain unaffected.

Server Log Files
The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:

– Browser type and browser version
– Operating system used
– Referrer URL
– Hostname of the accessing computer
– Time of the server request
– IP address

This data is not combined with other data sources.

New Relic – Server Monitoring and Error Tracking
We use server monitoring and error tracking to ensure the availability and integrity of our online services and to technically optimize them based on the data processed in this process.

For these purposes, we use the service provided by New Relic, Inc., Attn: Legal Department, 188 Spear Street, Suite 1200, San Francisco,
CA 94105, USA. New Relic processes aggregated performance data—that is, performance, load, and similar technical metrics—which provide information about the stability of our online service and any anomalies. In the event of errors or anomalies, individual requests from users of our online service are recorded pseudonymously to identify and resolve the sources of the problems. In this context, “pseudonymized” specifically means that users’ IP addresses are stored with the last two digits truncated (so-called IP masking). The aggregated data is deleted after three months; the pseudonymized data is deleted after seven days.

For more information on New Relic’s processing of personal data, please refer to the service’s privacy policy: https://newrelic.com/termsandconditions/privacy

Contact Form / Chat Tool
If you submit inquiries to us via the contact form, the information you provide in the form—including the contact details you enter there—will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not disclose this data without your consent.

The data you enter in the contact form will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Inquiries via Email, Phone, or Fax
If you contact us via email, phone, or fax, your inquiry—including all personal data contained therein (name, inquiry)—will be stored and processed by us for the purpose of handling your request. We will not share this data without your consent.

The data you send us via contact inquiries will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions—in particular statutory retention periods—remain unaffected.

§ 14 Purposes and Legal Bases for Processing
Cookies that are necessary for carrying out the electronic communication process or for providing certain functions you have requested (e.g., the shopping cart function) are stored based on UNIVERS Capital’s legitimate interest (Art. 6(1)(f) GDPR). The website operator has a legitimate interest in storing cookies to ensure the technically error-free and optimized provision of its services. To the extent that other cookies (e.g., cookies used to analyze your browsing behavior) are stored, these are addressed separately in this Privacy Policy.

Usercentrics
Usercentrics is used to obtain the legally required consents for the use of certain technologies. The legal basis for this is Article 6(1)(c) of the GDPR.

Server Log Files
Server log data is collected on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in ensuring the technically error-free display and optimization of its website—for this purpose, server log files must be collected.

New Relic
We use New Relic based on our legitimate interests in the security, error-free operation, and optimization of our online offering in accordance with Article 6(1)(f) of the GDPR.

Contact Form / Chat Tool
The processing of data entered into the contact form is therefore based exclusively on your consent (Article 6(1)(a) of the GDPR). You may revoke this consent at any time. To do so, simply send us an informal email. The lawfulness of data processing operations carried out prior to revocation remains unaffected by the revocation.

Inquiries via Email, Phone, or Fax
The processing of relevant data in connection with your inquiries is based on Article 6(1)(b) of the GDPR, provided that your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on your consent (Art. 6(1)(a) GDPR) and/or on our legitimate interests (Art. 6(1)(f) GDPR), as we have a legitimate interest in effectively processing the inquiries directed to us.

§ 15 Data Processing Following Registration on “universcapital.de”
You can register on our website to use additional features on the site. We use the data you provide for this purpose solely to enable you to use the specific offer or service for which you have registered. The required information requested during registration must be provided in full; otherwise we will reject the registration. As a service provider commissioned by the real estate companies advertising on the platform, we are obligated—among other things, to prevent money laundering—to verify the identity of our users. In addition to personal identification data, the required information includes the bank details necessary for processing the subject matter of the contract. The identity verification itself is carried out by a separate service provider, which only provides us with confirmation or non-confirmation of your identity, but no data from the verification process.

If you wish to register on the UNIVERS Capital website, all you need initially is an email address.

As soon as you wish to actively use our services, we will then request the following personal data:

– First name/Last name
– Title (optional)
– Gender
– Nationality
– Cell phone number (optional)
– Email address
– Phone number (optional)
– Address (optional)
– Date and place of birth (optional)
– Identification details (ID information: number, issuing authority, validity, etc.)
– Tax residency
– Tax ID (optional)
– Voluntary additional information (marital status, occupation, award system data)

The processing of the data entered during registration is based on your consent (Art. 6(1)(a) GDPR). You may revoke any consent you have given at any time. To do so, simply send us an informal email. The lawfulness of any data processing that has already taken place remains unaffected by the revocation.

We store the data collected during registration for as long as you remain registered on our website; it is subsequently deleted. Statutory retention periods remain unaffected.

Responsibility
The processing of personal data in connection with your registration and the use of our services is the responsibility of “UNIVERS Capital GmbH”.

Processing of Data (Customer and Contract Data)
We collect, process, and use personal data on behalf of the real estate companies advertising on the platform only to the extent necessary for the establishment, content, or modification of the legal relationship (inventory data). This is done on the basis of Art. 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. We collect, process, and use personal data regarding the use of our website (usage data) only to the extent necessary to enable the user to use the service or to bill for it.

The collected customer data is deleted upon completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data Transfer Upon Conclusion of a Contract for Services and Digital Content
We transfer personal data to third parties only if this is necessary for the fulfillment of the contract, such as to service providers responsible for identification or payment processing.

No further transfer of data takes place, or only if you have expressly consented to the transfer or if it is necessary within the scope of a legitimate interest. Your data will not be disclosed to third parties without your express consent, such as for advertising purposes. The legal basis for data processing is Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

§ 16 Purposes and Legal Bases of Processing

You have registered with us.

As part of the registration process, we necessarily process your login data, such as your email address.
The purpose of data processing at this stage is to expand our community and to facilitate business negotiations between the real estate company advertising on the platform and you. Your registration on the portal is considered the first step toward initiating business and contractual negotiations between you and the respective real estate company. In this respect, the legal basis for data processing is the performance of a contract (Article 6(1)(b) of the GDPR). You may revoke your consent to receive emails from us at any time. We will then cease sending you any further emails. We will retain your data for as long as the respective legal basis applies. If you have not made an investment, we will delete your data immediately upon your request.

Otherwise, we will delete your account after three months if we determine that you have not logged in during that period.

We do not transfer your data to a third country outside the EU or the EEA. Furthermore, your data is not shared with any other third parties. It remains within “UNIVERS Capital GmbH” and the real estate company advertising on the platform.

You have registered and identified yourself.

If, in addition to registering with us on the platform, you have also identified yourself, this indicates that you intend to make an investment with one of the real estate companies advertising on the platform. The purpose of the processing is the initiation or performance of a contract. The legal basis in this case would be the initiation of a contract within the meaning of Art. 6(1)(b) GDPR. The moment you opened a securities account with us via the platform, you also entered into a contract with the financial institution “Tangany GmbH” for securities account management. In this case, the legal basis is also Article 6(1)(b) of the GDPR.

In addition, we are required under the Money Laundering Act (GwG) to verify your identity when opening a securities account. In doing so, we are subject to a legal obligation under Article 6(1)(c) of the GDPR.

If you also wish to open a securities account, we will forward your data to the custodian bank so that we can record your bonds. The purpose of this transfer is to fulfill the contract by opening a securities account with our partner institutions. As long as you have not yet invested, we will delete your data after a certain period of inactivity on this platform, but no sooner than seven years. The GwG mandates a retention period of seven years for identification data following the opening of an account or securities account.

Your data will not be transferred to a third country outside the EU and the EEA.

You have already invested

In this case, the purpose of the processing is the performance or fulfillment of an existing contract. It is necessary for us to know to whom we are to make interest payments on behalf of the respective real estate company advertising on the platform.

In this case, your data is processed on the legal basis of contract performance and fulfillment pursuant to Article 6(1)(b) of the GDPR. Furthermore, your data is processed based on a legal obligation pursuant to Article 6(1)(c) of the GDPR. Notable examples here include the GwG, KWG, and KAG. As long as your investment remains active, we are not permitted to delete your data. The deletion of personal data also constitutes processing within the meaning of Article 4(2) of the GDPR and requires a legal basis. However, due to the aforementioned laws, as well as the German Fiscal Code (AO), we are subject to statutory retention periods that prohibit us from deleting certain data for a period of time specified by law. These retention periods remain in effect even after your investment with us has ended. The data may only be deleted once the retention periods have expired. The retention periods last for a maximum of ten years after the end of your investment.

§ 17 Data Processing During the Application Process
We process applicant data solely for the purpose of and within the scope of the application process, in accordance with legal requirements. The application process requires that applicants provide us with their applicant data. If we offer an online form, the required applicant data is marked and primarily consists of personal master data. Otherwise, it is specified in the respective job descriptions. Generally, this includes personal information (personal master data), mailing and contact addresses, as well as documents related to the application, such as a cover letter, resume, and the information contained in the attached certificates and supporting documents. In addition, applicants may voluntarily provide us with additional information.

By submitting their application to us, applicants consent to the processing of their data for the purposes of the application process in accordance with the manner and scope set forth in this Privacy Policy.
If available, applicants may submit their applications to us via an online form on our website. The data is transmitted to us in encrypted form using state-of-the-art technology.

Furthermore, applicants may submit their applications to us via email. However, please note that emails are generally not sent in encrypted form, and applicants must ensure encryption themselves. We therefore cannot assume any responsibility for the transmission of the application between the sender and receipt on our server and therefore recommend primarily using an online form or sending the application by mail.

Subject to a valid revocation by the applicant, the data will be deleted after a period of six months has elapsed, so that we can answer any follow-up questions regarding the application and fulfill our obligations to provide evidence under the Equal Treatment Act. Invoices for any travel expense reimbursements are archived in accordance with tax regulations.

§ 18 Purposes and Legal Bases for Processing
If applicant data is processed by UNIVERS Capital GmbH, such processing is carried out to fulfill our (pre)contractual obligations within the framework of the application process pursuant to Art. 6(1)(b) of the GDPR or Art. 6(1)(f) GDPR, provided that data processing becomes necessary for us, for example, in the context of legal proceedings (in Germany, § 26 BDSG also applies). In addition, your data is processed on the basis of your consent, to the extent that you have permitted us to retain your application on file.

To the extent that special categories of personal data within the meaning of Art. 9(1) of the GDPR are provided as part of the application process, their processing is additionally carried out in accordance with Article 9(2)(b) of the GDPR (e.g., health data, such as severe disability status or ethnic origin).

To the extent that special categories of personal data as defined in Article 9(1) of the GDPR are requested from applicants as part of the application process, their processing is additionally based on Article 9(2)(a) of the GDPR (e.g., health data, if such data is necessary for the performance of the job).

The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job opening is unsuccessful, the applicants’ data will be deleted. The same data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time.