Data Protection Rules B-Part
We would like to welcome you to the website of UMB Vermietungs und Betriebs GmbH (hereinafter referred to as “UMB” or “We”)
Data protection is very important to us. As a rule using the UMB website is possible without providing any personal data. However, if you want to make use of any specific services we offer via our website, it is possible that it may become necessary to process personal data. Where it is necessary to process personal data and where there is no statutory basis for any such processing, we will generally ask for your consent.
Any processing of your personal data, such as your name, address, email address or phone number will be carried out in compliance with the General Data Protection Regulation, and in concordance with any other data protection rules applicable to UMB. We would like to use this Data Protection Policy to notify you of the type, extent and purpose of the personal data we collect, use, and process.
Moreover, the Data Protection Policy sets out the rights that you have.
As the company responsible for the processing, UMB has put in place technical and organisational mechanisms to ensure that any personal data processed via this website are protected as comprehensively as possible. Notwithstanding this, transmission of data via the internet always incurs the risk of security problems, so that unfortunately it is not possible to guarantee complete protection. For this reason every user of our online services has the option of transmitting personal data to us in alternative ways, such as by telephone.
1. Name and contact details of the controller
For the purposes of the General Data Protection Regulation, any other data protection laws applicable in the member states of the European Union or any other regulations governing data protection, the Controller is
UMB Vermietungs und Betriebs GmbH (UMB)
2. Purpose and legal basis of data processing
2.1 Where you give consent
Article 6 (1) (a) of the GDPR is the legal basis for any such processing where we ask you to give consent for a specific processing purpose.
2.2 Where processing is necessary for the performance of a contract
Where processing of personal data is necessary for the performance of a contract to which you are a party, for example in the case of processing operations that are required in order to deliver goods or provide some other service or some consideration, the basis for any such processing is Article 6 (1) (b) of the GDPR. The same shall apply in respect of any such processing operations as are required for the performance of any precontractual steps, for example where there are enquiries in relation to our products or services, including in particular any enquiries made via the functionalities provided on this website.
2.3 Where processing is necessary for compliance with a legal obligation to which we are subject
Where our company is subject to a legal obligation, which makes the processing of personal data necessary, for example in order to comply with tax obligations, then any such processing is based on Article 6 (1) (c) GDPR.
2.4 Where processing is necessary in order to protect vital interests
In rare cases it may become necessary to process personal data in order to protect your vital interests or the vital interests of another natural person. This might be the case, for example, if you were injured during a visit to the premises of UMB, and we had to provide your name, age and other vital information to a doctor or hospital. In such cases any such processing would be based on Article 6 (1) (d) GDPR.
2.5 Where processing is necessary for the purposes of the legitimate interests pursued by us
Last but not least, processing operations may also be based on Article 6 (1) (f) GDPR. This covers such processing operations as are not covered by one of the above legal bases, but where processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. Such processing operations are permissible because they have been specifically mentioned by the European legislature. This stipulated that such legitimate interest could be assumed where the data subject is a client of the controller (second sentence of recital 47 GDPR).
Where the processing of personal data is based on Article 6 (1) (f) of the GDPR our legitimate interest is the performance of our business activity for the purposes of ensuring the interests of our company, our employees and our shareholders.
3. Recording general data and information
The UMB website records general data and information every time it is accessed by you or via an automated system. Such general data and information are stored in the server’s logfiles. The following data and information may be recorded:
- browser types and versions used,
- the operating system used by the system accessing the website.
- the website from which the system accessing the website was referred to our website (so-called Referrer),
- any sub-websites that are accessed via a system accessing our website,
- the date and the time of any such access to the website,
- the internet-protocol-address (IP-address),
- The internet service provider of the accessing system, and
- any similar data and information that serves to protect against any dangers of attacs on our IT systems.
UMB does not use these general data and information to draw any conclusions about you. Rather, this information is required in order to
- ensure that the content of our website can be delivered properly,
- optimise the content of our website as well as the advertising for this,
- ensure the permanent functionality of our IT systems and the technology for our website, and
- in order to provide any necessary inforation to law enforcement agencies in the event that there is a cyber attack.
Accordingly, the data and information thus collected anonymously are analysed statistically, and, further, for the purposes of improving the data protection and data security in our company, in order to ensure the best possible level of protection for the personal data processed by us. These anonymous data in the server logfiles are stored separately from any personal data provided by you.
4.1 What are cookies?
We use so-called “Cookies” on our website. Cookies are small text files which are stored on your hard drive via your browser. Cookies store certain information (e.g. your preferred language or page settings) that can be sent back to us when the website is accessed again (depending on the lifespan of the cookie).
4.2 What cookies do we use?
We distinguish between two categories of cookies:
- cookies that are technically necessary (technical cookies), and without which the functionality of our website would be limited, and
- optional cookies, for example for the purposes of website analysis or for marketing.
The following table sets out the optional cookies used on this website in more detail:
|Name(s)||Purpose and content||Validity|
|JSESSIONID||Technical identification of a session (visit to a website). No personal data are recorded. |
Placed by the system
|Length of session: This cookie is deleted when the browser is closed.|
|WHGACE||Load balancer cookie to ensure correct website behaviour. No personal data are recorded.||1 day|
|WHGCOOKIECONSENT||Remember choice for optional cookies: Storing the acceptance and/or rejection of optional cookies. No personal data are recorded.||6 months|
|Name(s)||Purpose and content||Validity||Provider|
|Google Analytics||Website analysis: |
These cookies assign a randomly generated ID to your devide, which allows us to recognise your device on your next visit. You can find further details on website analysis in the relevant chapter below.
|6 months||Google Inc.|
4.3 Where you give consent
We will only use optional cookies if you have given your consent (Art. 6 (1)(a) General Data Protection Regulation). When you visit our website for the first time, a banner will appear on our website, requesting your consent to our use of optional cookies.
If you give your consent, we will store a cookie on your computer and the banner will not be shown again during the lifespan of the cookie.
Thereafter, or if you actively delete the cookie at some earlier stage, the banner will be shown again when you next visit our website to request your consent again.
5. Web Analysis using Google Analytics
We use Google Analytics on this website, a web analysis service operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”).
You can withdraw your consent for web analysis at any time, either by downloading and installing the available browser plugin from Google, or by managing your consent in the table above, which sets an opt-out cookie. Both options will only prevent web analysis for as long as you use a browser on which you have installed the plugin, or, as the case may be, for as long as you have not deleted the opt-out cookie.
Alternatively it is possible to prevent future analysis of your page visit by Google Analytics by clicking the below link. Clicking that link sets a so-called opt-out cookie, which has the effect of preventing the analysis of your visit to our website in future. Activate opt-out cookies for Google Analytics!
6. Subscribing to our newsletter
Users have the option on our website of subscribing to newsletters offered by our company. The personal data that will be transmitted to the person responsible for processing this is indicated in the input screens used for subscribing.
Our newsletter can generally only be received by you if (1) you have a valid email address, and (2) you have registered for the newsletter. For legal reasons a confirmation mail is sent to the email address you first register for receiving the newsletter, for the purposes of a double-opt-in process. This confirmation mail serves to confirm that the owner of the email address as data subject authorises the newsletter to be sent to this email address.
When subscribing to our newsletter we also store the IP address assigned by the internet service provider (ISP) to the computer system you use at the time of registration, as well as the date and the time of the subscription being registered. Collecting these data is necessary in order to be able to reconstruct the (potential) abuse of the email address of a data subject at a later point in time so that this also serves for our legal protection.
The personal data collected as part of the registration process to subscribe to the newsletter will only be used for the purposes of sending out our newsletter. Furthermore, it is possible for recipients of the newsletter to be notified by email, where this is necessary in order to operate the newsletter service, or where registration is necessary, such as might be the case, for example, when there are changes to the newsletter offer, or where the technological circumstances change.
MailChimp is certified for compliance with the EU-US Privacy Shield, so that an appropriate level of data protection is currently given for data held by MailChimp in the United States. (https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active).
MailChimp have been engaged by us on the basis of our legitimate interests as per Article 6 (1) (f) GDPR and on the basis of a processing agreement as per the first sentence of Article 28 (3) GDPR.
MailChimp can use the recipient data in pseudonymised format for the purposes of optimising or improving their own services, e.g. in order to technically optimise the sending and presentation of the newsletter, or use it for statistical purposes. However, MailChimp does not use the data of the newsletter recipients in order to write to them directly, or to pass them on to third parties.
Nor are any personal data that are collected as part of the newsletter service transmitted to any third parties.
You may cancel your subscription to our newsletter at any time.
Any consent you give us regarding the dissemination of personal data for the purposes of sending out the newsletter can be withdrawn at any time. There is a link included in each newsletter for withdrawing your consent. Moreover, there is the possibility at any time to unsubscribe from the newsletter on our website, or to notify us thereof in some other manner.
7. Contact options via our website
As required by statute, the UMB website contains information enabling you to contact us quickly and electronically, as well as enabling you to contract us directly, which includes a general email address. If you contact us by way of a contact form or via email, the personal data transmitted by you will be stored automatically. Such personal data transmitted to us voluntarily by you will be stored for the purposes of dealing with your enquiry and to enable us to contact you. Such personal data will not be transmitted to any third parties.
8. Transmission of data for the purposes of processing on our behalf
In order to process your data we occasionally use specialised service providers. Our service providers are carefully selected by us and are regularly checked. They only process personal data at our behest and strictly follow our instructions, based on the respective processing agreements.
9. Period for which the personal data will be stored
The criterion for the period for which personal data will be stored is the applicable statutory retention period. After expiry of this period the relevant data will be routinely deleted, provided they are no longer required for the purposes of performing the contract or for initiating a contract.
10. Routine erasure and blocking of personal data
UMB only processes and stores personal data of the data subject for such a period as is necessary in order to achieve the purpose of storing them, or where this is prescribed in statutes or regulations by the European legislature or other legislatures and to which UMB is subject.
Where the purpose for storing the data no longer exists or if some other prescribed storage period of the European legislature or some other responsible legislature, the personal data are routinely blocked or erased in compliance with the applicable statutory provisions.
11. Information regarding your rights
If we process your personal data, you are entitled to the following rights, based on the applicable data protection laws. If you want to exercise one or several of these rights, you can contact our data protection officer at any time.
11.1 Right to information
The European legislature has enshrined the right that at any time you can request information from the controller regarding the personal data that are stored in respect of you, to receive a copy of this information and to do so free of charge. Moreover, the European legislature has granted the data subject the right to information regarding the following matters:
- the purposes of the processing
- the categories of personal data concerned
- the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing
- the right to lodge a complaint with a supervisory authority
- Information to be provided where personal data have not been obtained from the data subject: Any available information about the origin of those data;
- the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Moreover you are entitled to obtain information about whether any personal data were transmitted to a third country or to an international organisation.
Where this is the case you also have the right to obtain information regarding the appropriate safeguards in connection with such transmission.
11.2 Right to rectification
As stipulated by the European legislature, you have the right to obtain from the us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
11.3 Right to erasure (‘right to be forgotten’)
As stipulated by the European legislature, you have the right to obtain from UMB the erasure of personal data concerning you without undue delay where one of the following grounds applies, and where processing is not necessary:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- You withdraw your consent on which the processing is based according to Article 6 (1) (a), or Article 9 (2) (a), and where there is no other legal ground for the processing;
- You object to the processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR.
- The personal data have been unlawfully processed.
- The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which UMB is subject;
- The personal data have been collected in relation to the offer of information society services referred to in species; 8(1) GDPR.
Where these rights are asserted UMB’s data protection officer shall arrange that the erasure request is complied with without delay.
Where UMB has made the personal data public and is obliged pursuant to Article 17 (1) GDPR to erase the personal data, then UMB, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers who are processing the personal data that you have requested the erasure by such controllers of any links to, or copy of, those personal data, provided that processing is not necessary. UMB’s data protection officer will make the necessary arrangements on a case by case basis.
11.4 Right to restriction of processing
As stipulated by the European legislature, you have the right to demand a restriction of processing from us, where one of the following applies:
- The accuracy of the personal data is contested by you, for a period enabling UMB to verify the accuracy of the personal data;
- The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- UMB no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
- You have objected to your personal data being processed as per Article 21 (1) GDPR, and it has not yet been ascertained whether UMB’s legitimate grounds override your legitimate interests.
11.5 Right to object
As stipulated by the European legislature, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR. This also applies in relation to any profiling based on these provisions.
Where an objection is lodged, UMP shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
Where personal data are processed for the purposes of direct marketing,you have the right to object to such processing of your personal data, to the extent that it is related to such direct marketing, at any time. This also applies in respect of profiling, to the extent that this is connected to any such direct marketing. Where you lodge your objection with UMB regarding the processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Where personal data are processed by UMB for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), you, on grounds relating to your particular situation, have the right to object to the processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
11.6 Right to data portability
As stipulated by the European legislature, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit those data to another controller without hindrance from UMB, wherethe processing is based on consent as per Article 6 (1) (a) GDPR or Article 9 82) (a) GDPR, or where it is based on a contract as per Article 6 (1) (b) GDPR, and where the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In exercising your right to data portability pursuant to Article 20 (1) GDPR, you have the right to have the personal data transmitted directly from UMB to another controller, where this is technically feasible and where this does not infringe the rights and freedoms of others.
11.7 Automated individual decision-making, including profiling
As stipulated by the European legislature, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, provided that (1) this decision is not required for concluding or performing a contract between you and UMB, or (2)it is permissible pursuant to legal provisions of the Union or the member states, which UMB is subject to, and where such legal provisions include appropriate measures in order to safeguard your rights and freedoms as well as your legitimate interests, or (3) where this takes place with your express consent.
However, as a responsible company UMB refrains from using any automated decision making process or profiling.
11.8 Right of withdrawal of consent in relation to data protection
As stipulated by the European legislature, you have the right to withdraw any consent you have given for the processing of personal data at any time.
The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
11.9 Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
If you have any comments or requests regarding data protection, please send them to firstname.lastname@example.org or contact our data protection officer at the following address:
Anika von Ribbeck
Strategic Enterprise AG
Fehrbelliner Straße 47e
Tel. +49 (0) 30 440 373 81
Fax +49 (0) 30 440 318 84
13. Legal or contractual provisions regarding the making available of personal data; Necessity for concluding a contract; Obligation of the data subject to make personal data available; Possible consequences of not making data available
You are hereby notified that making your personal data available can be prescribed by law (e.g. tax law) or that such an obligation may arise from contractual provisions (e.g. details of the parties). Sometimes it can be necessary in order to conclude a contract that you make personal data available to us, which thereafter need to be processed by us. For example, you have an obligation to provide us with personal data if our company enters into a contract with you. Not making such personal data available could lead to a situation where we are unable to conclude the contract with you. Before making any personal data available, you are very welcome to contact our data protection officer. Our data protection officer will inform you on a case by case basis, whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide such personal data and what the possible consequences of failure to provide such data would be.
14. Amendments of the Data Protection Policy
We reserve the right to update this Data Protection Policy from time to time where this is necessary. Any such amendments will be published on our website. Any amendments shall be binding as soon as they are published on our website.
For this reason we would recommend that you regularly visit our website to check whether there have been any updates.