Data Protection and Cookie Statement

1. Introduction

For us, OTTO Immobilien GmbH, Riemergasse 8, Tel: + 43 1 512 77 77, Fax: +43 1 513 77 78, E-mail: office@otto.at, (“OTTO”,“we”), the protection of your personal data is very important. We therefore process your personal data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (“GDPR”), the applicable Data Protection Act (“DSG) and the Telecommunications Act (“TKG”). In the following you will learn which information we collect, process and use when you visit and use our website luxury.otto.at (“website”).

The provision of the data is not required by law or contract. In some cases, however, your use of the website may be limited if you do not provide us with any personal data.

There is no automated decision-making.
We may need to update this privacy and cookie policy from time to time as the Internet develops. We therefore recommend that you check this page at regular intervals to ensure that you have read the latest version.

2. What is personal data?

Personal data is information about data subjects whose identity is determined or at least determinable. This includes your name, e-mail address and your IP address, for example.

3. Which data do we collect from you, and why?

3.1. Contacting us
If you contact us by e-mail, telephone, fax, postal or via our contact form, we process your personal data (e-mail, name, telephone) and the content of your enquiry for the purpose of processing it (prior to entering into a contract pursuant to Article 6(1)(b) GDPR) and store the above data in case of follow-up questions for six months (legitimate interest in offering individual, satisfactory customer service pursuant to Article 6(1)(f) GDPR). Of course we will not forward your enquiry to third parties without your consent.

If you contact us via our social media pages on Facebook, Instagram or LinkedIn, we process the data you provide in order to respond to your enquiry prior to entering into a contract or within the scope of our legitimate interests in the processing of your enquiry (customer support). For this purpose, we receive your personal data from the respective operator of the social media platform and also transmit your personal data to the respective operator. Insofar as this involves a transmission in countries without an adequacy decision according to Article 45(3) GDPR and without appropriate safeguards according to Article 46 GDPR, such as the USA in particular, you should be aware that there is a risk that your data transmitted in this way are subject to access by authorities in these third countries for control and surveillance purposes and that there are no effective remedies available.

3.2. Contact for advertising purposes
If you provide us with your consent to be contacted by us for advertising purposes, we will process your e-mail address, name, telephone number and title for the purpose of sending you direct marketing materials about properties and related offers, in-depth market reports, events and similar services from the property sector by e-mail and telephone. If you receive a download link for documents via our CRM system, we can also see if and when (date and time) you downloaded the files.

You can revoke your consent to advertising contact at any time, without giving reasons, for all or individual purposes and with effect for the future (e.g. via a link at the end of each newsletter).

If you forward our newsletter to third parties, you are obliged to comply with the legal provisions and to obtain the prior consent of the recipient. If a third party asserts claims against us due to the forwarding of a newsletter by you, you will indemnify and hold us harmless in respect of all related claims, including penalties and costs of legal defence.

3.3. Technical data (logfiles)
When you visit our website, we record the IP address of your device, the date and time of access, the Internet browser used and your operating system, your click behaviour on the website, your Internet provider and the website from which you visit us.

This data is automatically generated by our servers when you use our website and is necessary for us to provide you with the services you require. We therefore process log files only in order to make our website and the related services available to you, to identify you as an authorised user, to distribute web server queries on our server pool and for security reasons (e.g. to investigate abuse or fraud). This data processing is therefore necessary to protect our legitimate interests in providing a user-friendly and secure website (Article 6(1)(f) GDPR in conjunction with Section 96(3) Telecommunications Act (TKG)).

3.4. Transfer to third parties
We also transmit your personal data to the necessary extent to external agents or service providers(processors):

– to IT service providers and/or providers of data hosting or data processing or similar services;

– to other service providers, providers of tools and software solutions that also support us in the provision of our services and act on our behalf (including providers of marketing tools, marketing agencies, communication service providers and call centres). All our order processors process your data only on our behalf and based on our instructions so that we can make our online services available to you. In addition, we will transmit your personal data to the following recipients (responsible persons) to the extent necessary:

– any third parties involved in the fulfilment of our obligations to you (e.g. banks);

– other external third parties to the extent necessary (e.g. auditors, insurers in the event of an insurance claim, legal representatives if required, etc.);

– public authorities and other public bodies to the extent required by law (e.g. financial authorities, etc.).

If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA), or if this occurs when using third-party services, it will only be processed if it is required in order to fulfil our (pre)contractual obligations, based on your consent, based on a legal obligation or based on the pursuit of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection requirements. If we process or have your data processed in third countries, we will provide you with a copy of these appropriate safeguards at your request.

4. Cookies

Our website uses cookies insofar as this is technically absolutely necessary for the use of the website or you have given your consent. Cookies are small text files that are stored on your device with the help of the browser.

We use cookies to make our website and the services we offer user-friendly. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser next time you visit us.

If you do not wish this, you can set up your browser so that it informs you about the setting of cookies and you only allow this in individual cases. If you disable cookies, the functionality of our website may be restricted.

With the exception of technically necessary cookies (Section 96(3) Telecommunications Act (TKG)), we only use cookies when you use our online services based on your prior active and voluntary consent via our cookie banner (Section 96(3) TKG 2003 in conjunction with Article 6(1)(a) GDPR).

The cookies used on our website can be divided into three categories:
a) Necessary cookies help make a website usable by enabling basic functions such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies. Therefore, these cookies cannot be deselected.
b) Preference cookies allow the recall of information that affects the way a website behaves or looks, such as your preferred language or region.
c) Statistics cookies (tracking cookies) help us understand how visitors interact with our website by collecting and reporting information anonymously.
d) Marketing cookies are used to track visitors to websites and to exploit any data collected by statistical cookies (tracking cookies). The intention is to show ads that are relevant and appealing to the individual user and are therefore more valuable to publishers and third-party advertisers.
When you visit our website, a window appears with a brief summary about the purposes for which we and third-party providers want to use cookies (cookie banner). You can generally agree to the use of all cookies for the purposes stated in the cookie banner by clicking the ‘Accept’ button. You can click the ‘Settings’ button to access the cookie settings. Here you can view more detailed information about cookies and choose whether or not you want to allow the corresponding cookies, either per category (e.g. ‘necessary cookies’, ‘marketing cookies’) or individually per cookie. With the exception of ‘necessary cookies’, you can simply deselect all cookies.

You can also revoke your consent at a later time by deselecting the corresponding cookies in the ‘Cookies’ section of the ‘Privacy settings’ in the footer.

If your selected settings or your voluntary consent also include providers who transmit data in countries without an adequacy decision according to Article 45(3) GDPR and without appropriate guarantees according to Article 46 GDPR (such as the USA in particular), your consent according to Article 49 GDPR shall also apply to them. There is a risk that your data transmitted in this way will be subject to access by authorities in these third countries for control and surveillance purposes and that no effective remedies will be available.

4.1 Social plugins
If you have given your consent to marketing cookies in the cookie banner, our website uses a social plugin from Facebook Ireland Ltd, 4 Grand Canal Square Grand Canal Harbour Dublin 2 and from LinkedIn Ireland Unlimited Company, Wilton place, Dublin 2, Ireland.

When you visit a page of our website that contains such a social plugin, your device establishes a direct connection to the servers of the respective provider. The content of the social plugin is then transmitted directly to your device by the respective provider and integrated into our online offering by this provider. By integrating the social plugins on our website, the respective provider of the social network receives the information that you have accessed the corresponding page of our online services. If you are logged in to the respective social network, the provider can assign your visit to your specific account on the platform. If you interact with the social plugins, for example, by clicking the Facebook ‘like’ button, the corresponding information is transmitted directly from your device to the respective provider of the social network and stored there. If you are not a member of social networks, the respective providers may nevertheless detect and store your IP address.

The respective provider of the social network can create user profiles about you based on the data about your visit to our website and your use of our online services.

For more information about data collection and the processing and use of data by Facebook, click here: https://www.facebook.com/about/privacy or here: https://www.linkedin.com/legal/privacy-policy.

5. Duration of storage

We only store your personal data as long as necessary for the purposes for which it is processed. Furthermore, we may be obliged to retain your data for a longer period of time due to applicable statutory retention periods.
For reasons of the tax and company law storage obligations that apply to us, we generally store your personal data provided in connection with offers and subsequent contractual relationships for seven years after fulfilment of the contract. We store your personal data transmitted in the context of enquiries for a period of six months after answering the enquiry, in order to be able to respond to any follow-up questions.
If you have only registered for newsletters and the receipt of advertising information and are not a customer of ours, we store your personal data until you revoke your consent and for a maximum of three years.

Access data and log files are stored for a maximum of 500 days and then deleted.

If an employment relationship is established, we will keep your applicant data for the duration of employment and will store them after your employment has ended for as long as we are legally required to retain them (generally seven years for all relevant documents as defined in Section 132 of the Austrian Federal Fiscal Code (BAO) and Section 212 Austrian Commercial Code (UGB) or as long as legal claims from the employment relationship can be asserted against the employer (usually three years). Personal data, which are required for the issue of a service certificate according to Section 39 of the Austrian Labour Constitution Act (ArbVG) and Section 1163 of the Austrian Civil Code (ABGB) are, in any case, retained for a period of 30 years. In addition, we also store your personal data beyond the specified time limits should the need arise, for the duration of the period in which legal claims arising from the relationship between you and us can be asserted, or until the final clarification of a specific incident or legal dispute. The purpose of this longer retention period is to protect our legitimate interests in the assertion, clarification and defence of legal claims.

6. Data security

We take appropriate technical and organisational security measures to protect your personal data against accidental or unauthorised deletion, alteration or against loss, theft and unauthorised viewing, disclosure, reproduction, use, modification or access. We and our employees are also obliged to maintain data secrecy and confidentiality. Likewise, our vicarious agents and representatives, who must have access to your personal data in order to perform their professional duties, will be granted access and will be subject to the same obligations to maintain data secrecy and confidentiality.

7. Your rights as the data subject

You may request information regarding the data stored about you at any time. Under certain circumstances you may also request the correction or deletion of your data. You may also have a right to restrict the processing of your data and a right to receive the data provided by you in a structured, common and machine-readable format. Furthermore, you have the right to revoke any consent granted at any time with effect for the future.
Furthermore, you have a right to object to data processing on grounds relating to your particular situation (Article 21 GDPR). In particular, you have the right to object to the processing of your data for direct marketing purposes.
You have the option to lodge a complaint with a data protection regulator. The data protection regulator responsible for us is: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria.
If you have any questions, you can also contact us:

OTTO Immobilien GmbH
Riemergasse 8
Tel: + 43 1 512 77 77
Fax: +43 1 513 77 78
E-mail: office@otto.at

To enable us to process your request regarding your above-mentioned rights and to ensure that personal data is not disclosed to unauthorised third parties, please submit your request with clear identification of your person and a brief description of the scope of the exercise of your above-mentioned data subject rights.

Last updated: March 2021