Privacy policy of WISTA.Plan GmbH
Last updated: November 2022
Protecting your data and privacy is very important to us. In the following document, we outline how we process your personal data and provide you with other relevant information regarding your privacy.
General
1. Data Protection Officer
If you have any questions relating to the processing of your personal data, or to exercising your rights under the GDPR, please contact our data protection officer at:
2. What are your rights?
Depending on each individual case, you have the following rights relating to your personal data. If you wish to exercise any of these rights, please contact us, or our data protection officer, by using the provided contact details.
a) Information
You have the right to obtain information about the personal data processed by us and to gain access to your personal data and/or request a copy of these data. This includes information on the use and the categories of processed data, the recipients and authorised processors, as well as, where applicable, the planned duration of storage, or, where not possible, the criteria for data storage.
b) Rectification, erasure, and restriction of processing
You have the right to request the rectification of false personal data without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
c) Right to object
For personal data processed based on point (e) or (f) of Article 6 (1), you have the right to object, on grounds relating to your particular situation, to the processing of personal data at any time. We will cease to process these personal data unless we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.
d) Right to withdraw consent
Where data processing is based on consent, you have the right to withdraw this consent. This does not affect the lawfulness of processing based on consent before its withdrawal. Please contact us, or our data protection officer, any time using the provided contact details.
e) Right to erasure
You have the right to request erasure of your personal data without undue delay, and we are obligated to erase personal data without undue delay where one of the following points applies:
- The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
- You withdraw consent on which the processing is based according to point 2 c) and there is no other legal ground for the processing
- The personal data have been unlawfully processed.
- The personal data must be erased for compliance with a legal obligation in Union or Member State law to which we are subject.
This does not apply to the extent that processing is necessary:
- To comply with a legal obligation which requires processing by Union or Member State law to which we are subject.
- For the establishment, exercise, or defence of legal claims.
f) Right to restriction of processing
You have the right to obtain from us the restriction of processing where one of the following applies:
- You contest the accuracy of the personal for a period enabling us to verify the accuracy of the personal data,
- the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead,
- we no longer need the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of legal claims,
- you object to processing pursuant to point 2 c) pending the verification whether our legitimate grounds override yours.
Where processing has been restricted under this point f), such personal data shall, with the exception of storage, only be processed with your consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. Where you have obtained restriction of processing, we will inform you before the restriction of processing is lifted.
g) Right to data portability
According to Art. 20 GDPR, you have the right to obtain the personal data concerning you in a structured, commonly used and machine-readable format and you have the right to transmit those data, if technically possible, to another controller where the processing is based on consent.
h) Right to lodge a complaint
According to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority without prejudice to any other administrative or judicial remedy, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
I. For Real Estate Enquiries:
1. Who is responsible for processing your personal data?
WISTA.Plan GmbH, urban development agency and trustee of the State of Berlin, Rudower Chaussee 19, 12489 Berlin is the controller according to the EU General Data Protection Regulation (‘GDPR’).
2. Which categories of personal data do we process?
We process data related to your real estate enquiry. These include general personal information such as your contact details (name, address, email, phone number) as well as data that you provide by communicating with us, including, for example, your planned use of a property, your professional affiliation, emails, telephone notes, correspondence, or other information submitted relating to your request.
We would like to point out that in view of the financial risk of default on the part of our prospective real estate buyers, we have a credit check carried out by Creditreform (Verband der Vereine Creditreform e. V., Hammelfelddamm 13, 41460 Neuss). Most of the data transferred to Creditreform and the data we receive from Creditreform are not personal data.
We share the following personal data with Creditreform for credit risk assessment purposes:
- Name, address, email address, phone number, website
If we review information from prospective real estate buyers, we receive the following information from Creditreform:
- Company dossier with analyses, payment experiences, balance sheet creditworthiness, creditworthiness index, and detailed business information.
- If any changes occur within 12 months with regard to the above-mentioned information on the company, Creditreform will inform us of these after 12 months.
If we review information from private individuals, we receive the following information from Creditreform:
- Name, address, email address, phone number, website
3. For which purpose and on which lawful basis do we process your personal data?
We collect the personal data named in I. (2) in accordance with data protection regulation:
a) For the performance of a contract Art. 6 (1) (b) GDPR
We process your data for the purpose of responding to your request for a property.
b) Based on your consent Art. 6 (1) (a) GDPR
Processing for one or more specific purposes is lawful because you have consented to the processing of your personal data for one or more specific purposes.
c) For the performance of a task carried out in the public interest Art. 6 (1) (e) GDPR in conjunction with § 3 BDSG
Processing of your personal data is necessary for the performance of a task carried out in the public interest. The State of Berlin has commissioned us as an urban development agency with the task of performing a development measure. This includes the marketing and selling of properties in the context of the Berlin-Johannisthal/Adlershof development measure.
d) Based on legitimate interests Art. 6 (1) (f) GDPR
We may process your personal data where it is required to reject legal claims in the context of selling properties. Our legitimate interest is, for example, the obligation of proof during a procurement procedure.
Moreover, we may process your personal data, if required, to perform a local needs assessment and to comply with accountability obligations towards the State of Berlin, our trustor and the owner of the properties.
The processing of your personal data in connection with the credit check is based on our legitimate interest in reducing our typical financial default risk in real estate.
4. What are the sources of personal data, where they are not obtained from you?
In principle, we only process data provided to us directly by you. However, we may process publicly available, company-related information from, for example, company websites.
In connection with the credit check, we receive the following personal data about you from Creditreform.
5. Who receives the data?
We may transmit your personal data to cooperating companies as well as the State of Berlin, our trustor and owner of the properties, where this is lawful pursuant to the purposes and legal basis laid out in I. (3). Moreover, we carry out processing of personal data pursuant to Art. 28 GDPR.
In connection with the above-mentioned credit check, we transfer the following personal data to Creditreform (Association of Associations Creditreform e.V., Hammfelddamm 13, 41460 Neuss).
6. Do we intend to transmit data to a third country?
We have no intention to transmit data to a third country.
7. What is the duration of storage?
We store your personal data for the duration of the development measure, where this is necessary. Your data will be erased, when either the development measure has been completed and after the periods have expired allowing the establishment of legal claims against us, or our trustor, the State of Berlin. The duration of storage extends in the case of legal disputes.
8. Are you required to provide us with your personal data
You are neither legally, nor contractually required to provide us with personal data. However, providing us with your personal data is required to complete a building lease. We are not able to respond to your enquiries if you do not provide us with the necessary personal data.
II. For job applicants:
1. Who is responsible for processing your personal data?
WISTA.Plan GmbH, Rudower Chaussee 19, 12489 Berlin is the controller pursuant to the EU General Data Protection Regulation (“GDPR”).
2. Which of your personal data do we use?
We process your personal data to the extent necessary for carrying out the job application process. This includes the following data categories:
Standard information:
- Key data of the applicants (First name, last name, address, job position)
- Data on qualifications (Cover letter, CV, job history, professional qualification)
- (Work) references and certificates (performance data, assessment data, etc.)
Special information that is required for certain positions:
- Police clearance certificate
Requirement for young people’s entry into work life:
- a medical certificate of a fitness test – § 32 Youth Labor Protection Laws (whether you suitable, not suitable, somewhat suitable, suitable to a limited degree)
Other information:
- Publicly accessible, job-related information, for example, a profile on professional social media networks
- Voluntary information, e.g., an application photo, information on severely disabled status or any other information that you voluntarily disclose in your application.
3. What are the sources of personal data, when they are not obtained from you?
We process personal data that we receive from you as part of the job application process and from public sources, i.e., from professional social networks.
We may receive personal data from other companies of our corporate group or from service providers for the placement of applicants.
4. For which purpose and on which lawful basis do we process your personal data?
We process your personal data in compliance with the General Data Protection Regulation (GDPR), the Federal Statistics Act (BDSG), and all other relevant laws.
4.1. Data processing for the purpose of the employment relationship § 26, 1, BDSG
Personal data of applicants may be processed for the purpose of the application process if this is necessary for the decision on the establishment of an employment relationship with us.
The necessity and the scope of the data collection are assessed, among other things, according to the position to be filled. More extensive data collection may be necessary if your desired position involves carrying out particularly confidential tasks, increased personnel and/or financial responsibility, or is linked to certain physical and health requirements. In order to safeguard data protection, such data processing will only take place after the selection of applicants has been completed and immediately prior to your recruitment.
4.2. Data processing based on consent given by you Art. 6 (1)(a) GDPR; § 26,2, BDSG
If you have given us voluntary consent to collect, process, and transmit certain personal data, this consent is the basis for the lawful processing of these data. We process your personal data based on your given consent in the following cases:
- Inclusion in the job applicant pool, i.e., we store your application documents for longer than the current job application process for consideration in later job application processes.
- Transfer of your application to companies of our corporate group
4.3 For the purposes of the legitimate interests pursued by the controller Art. 6 (1)(f) GDPR
In certain cases, we process your data for the purposes of the legitimate interest pursued by us or a third party.
- For the defence of legal claims in proceedings under the General Equal Treatment Act. In the event of a dispute, we have a legitimate interest in processing the data for evidence purposes.
5. Who receives the data?
We may transmit your personal data to cooperating companies, where this is lawful pursuant to the purposes and legal basis laid out in II. (4). Moreover, we carry out the processing of personal data pursuant to Art. 28 GDPR.
Your data are primarily processed by our human resources department and the head of the department responsible for filling your position. However, in some cases other internal and external bodies are also involved in the processing of your data.
Internal positions:
- Human resources department
- Head of department
Companies in the corporate group:
- WISTA Management GmbH
- WISTA.Service GmbH
External service providers:
- Providers of job applicant management systems
- IT service providers (e.g., maintenance service providers, hosting providers)
- Service providers for file and data destruction
6. Do we intend to transmit data to a third country?
We have no intention of transmitting data to a third country.
7. What is the duration of storage?
Your data are stored for the duration required by the decision on your job application, or after the expiration of the period required for defence against the establishment of legal claims by applicants. The duration of storage extends in the case of legal disputes. Your data are regularly deleted within a period of six months after the job application process.
If an employment relationship does not come about, but you have given us your consent for the further storage of your data, we will store the data until you revoke your consent but for a maximum of one further year. If there is a specific reason, we may also store your data for a longer period of time for the purpose of defending against possible legal claims.
8. Necessity of providing personal data
The provision of personal data is neither legally nor contractually required and you are not obligated to provide us with personal data. However, the provision of personal data is required for carrying out the job application procedure. This means that if you do not provide us with personal data when applying, we will not be able to carry out the application process.
9. What are your rights?
Exercising your rights:
To exercise your rights, you can contact the data controller or the data protection officer via the contact details provided, or the HR department at bewerbung(at)wista-plan.de.
We will process your request without delay and in accordance with the legal requirements and inform you of the measures we have taken.
10. Changes to this information
If there is a substantial change in the purpose or manner of processing your personal data, we will update this information and inform you of the changes in a timely manner.
III. For Bidders / Applicants in Procurement Procedures:
1. Who is responsible for processing your personal data?
Depending on the procurement procedure, the data controller is either WISTA.Plan GmbH, urban development agency and trustee of the State of Berlin, Rudower Chaussee 19, 12489 Berlin, data controller in accordance with the GDPR, or WISTA.Plan GmbH, authorised representative of the State of Berlin, Rudower Chaussee 19, 12489 Berlin, or WISTA.Plan GmbH, Rudower Chaussee 19, 12489 Berlin.
Please note that this privacy policy only applies to the processing of personal data as a part of procurement procedures and, where applicable, a subsequent contractual relationship. The Senate Department for Urban Development and Housing is the data controller as laid out in the EU General Data Protection Regulation (‘GDPR’) for the procurement platform of the State of Berlin and responsible for processing personal data as part of the communication through that procurement platform.
2. For which purpose and on which lawful basis do we process your personal data?
We process your personal data pursuant to § 3 in conjunction with. § 2 Abs. 2 BlnDSG for the purpose of conducting a procurement procedure and, where this is required, the initiation, establishment, and performance of a contractual relationship.
Moreover, we may process your personal data pursuant to Art. 6 (1) 1 f) GDPR, where this is required for the defence of legal claims against us. Legitimate interest may include, for example, the obligation of proof in legal proceedings. Moreover, your personal data are processed pursuant to Art. 6 (1) (c) GDPR where this is required to comply with legal obligations (for example, enquiries into the corruption register pursuant to § 6 Abs. 1 Bln KRG, enquiries into the financial sanction list on the basis of the EU regulation for combating terrorism, as well as legal regulation pertaining to procurement and taxes).
Processing for one or more specific purposes is lawful because you have consented to the processing of your personal data for one or more specific purposes pursuant to Art. 6 (1) a) GDPR.
3. Which categories of personal data do we process?
We process data related to your tender and your interest in the procurement procedure. This may include personal data of your management as well as data you have provided on your staff.
Full name(s)
Birth date, birth place
Gender
Education
Vocation
Workplace
Job experience
Credentials
4. What are the sources of personal data, where they are not obtained from you?
In principle, we collect data from you directly. We only process data that you have provided to us in the context of a procurement procedure.
5. Who receives the data?
We may transmit your personal data to cooperating companies, where this is lawful pursuant to the purposes and legal basis laid out in III. (2). (Example: Accounting).
Moreover, we transmit your data to our contracting authority, funding body, and trustor to the extent to which that is necessary to fulfil contractual and accountability obligations.
Furthermore, processing of your personal data is carried out on our behalf based on contracts pursuant to Art. 28 GDPR.
Where legally required, we transmit your personal data for the purpose of an enquiry to the government agency responsible for the corruption register.
6. Do we intend to transmit data to a third country?
We have no intention to transmit data to a third country.
7. What is the duration of storage?
We store your personal data for the duration of the procurement procedure pursuant to Bln. LHO and, in addition, for seven years after the completion of the procurement procedure. If we enter a contractual relationship, we will store your personal data for the duration of said contractual relationship and, in addition, for seven to eleven years after termination of the contractual relationship in accordance with the requirements of tax regulation.
Where your data are processed to perform a procurement procedure as part of the trust order, or to acquire funding, the storage period for your personal data is based on legal storage periods for trust assets and funding. This applies whether we enter a contractual relationship at the end of the procurement procedure.
8. Are you required to provide us with your personal data?
You are neither legally, nor contractually required to provide us with personal data. However, providing us with your personal data is required to sign a building lease with us. We will not be able to respond if you do not provide us with your personal data as part of your inquiry.