Privacy Policy

Data protection notice of the Instone Group

The protection of your personal data is very important to us. Below you will first find general information on data protection. In addition, we provide further information with regard to the respective specific processing situations and online presences.

If you have any further questions on the subject of data protection, please do not hesitate to contact us at any time. For example, you can send your request by e-mail to our data protection team at datenschutzteam@instone.de.


A. General data protection information

I. Controller
As the parent company of the Instone Group, Instone Real Estate Group SE is generally centrally responsible for the processing of personal data. If, in individual cases, another Group company or a third party is responsible, you will be informed of this separately.

You can reach the controller at:

Instone Real Estate Group SE
Grugaplatz 2-4
45131 Essen
Deutschland
Phone: +49 201 453550
Fax: +49 201 45355-934
E-mail: info@instone.de

II. Data Protection Officer
You can reach the data protection officer at:

Data Protection Officer
c/o Instone Real Estate Group SE
Grugaplatz 2-4
45131 Essen
Deutschland
E-mail: datenschutzbeauftragter@instone.de

III. Recipients of data
In principle, personal data is processed in our systems and only transmitted to other recipients or made accessible to them if it is necessary for the performance of our services or if there is another legal basis.
Depending on the purpose for which we collect your data, we may also share your personal data with other units within the group of companies as well as with service providers or cooperation partners. Your data may also be passed on to public bodies within the scope of our legal obligations or with your consent. In this respect, please also note the supplementary information regarding the specific processing situations.

The categories of possible recipients of your personal data are:

· various IT service providers in the operation of our IT systems and in the provision of our Internet offerings and other digital services;
· Notaries and lawyers in connection with the conclusion of contracts or the assertion of claims;
· Sales partners (in particular brokers) and other service providers (e.g. tradesmen) who are commissioned in the context of contract initiation, execution or after-sales service;
· Payment service providers and banks in the processing of payments and credit transactions.

If you would like to find out more details about the recipients, please contact datenschutzteam@instone.de.

IV. International transmissions
In principle, your personal data will be processed exclusively within the European Union (EU) or the European Economic Area (EEA) and only exceptionally transferred to recipients in countries outside the EU or the EEA (so-called third countries).

Any international data transfers only take place if there is an adequacy decision by the EU Commission for the third country or if the recipient can guarantee an adequate level of data protection on the basis of Art. 46 GDPR (EU standard contractual clauses). The standard contractual clauses published by the EU Commission can be found here. We will be happy to provide you with additional information on request at datenschutzteam@instone.de. 

V. Storage duration
In principle, personal data is only stored for as long as it is still required for the purposes for which it was collected or transmitted. Once the purposes have been achieved or further processing of the data for these purposes is no longer necessary, the data will be deleted. 
In certain processing situations, however, personal data may need to be stored or further processed due to mandatory legal requirements, for the purpose of preserving evidence or for other legitimate purposes. In these cases, the data will only be deleted when its storage is no longer required for these other purposes.

IV. Rights of data subjects
As the data subject, you have the following rights:

1. Right to access, Art. 15 GDPR
You have the right to request information about whether and, if so, which personal data is being processed. You can also request a copy of the data.

2. Right to rectification, Art. 16 GDPR
You have the right to demand that we correct and/or complete your personal data processed by us if it is incorrect or incomplete.

3. Right to erasure, Art. 17 GDPR
Under the conditions of Art. 17 GDPR, you have the right to request the erasure of your personal data. The data will then be deleted immediately, unless one of the reasons stated in Art. 17 para. 3 GDPR precludes deletion.

4. Right to restriction of processing, Art. 18 GDPR
Under the conditions of Art. 18 GDPR, you have the right to request the restriction of the processing of personal data concerning you.

5. Right to data portability, Art. 20 GDPR
You have the right to data portability under the conditions of Art. 20 GDPR. If the requirements are met, you can receive your data in a structured and machine-readable format and transmit it to another controller.

6. Right to withdraw consent, Art. 7 para. 3 GDPR
You have the right to withdraw your consent to the processing of personal data at any time with effect for the future. This does not affect the legality of the processing carried out up to the time of revocation.

7. Right to object, Art. 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR. If data is processed for advertising purposes, you can object to the processing at any time without giving reasons.

8. Right to lodge a complaint with the supervisory authority, Art. 77 GDPR
Without prejudice to any other legal remedies, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.



B. Additional information on processing
Below you will find additional information on the purposes and legal bases of the respective processing as well as on the type of data processed, on categories of possible recipients and on the storage period.

I. General information for website visitors 
We operate the following websites: 

https://www.instone.de
https://www.instone-group.de 
https://www-nyoo-by-instone.de

Below you will find general information on the processing of your personal data when you visit the websites as well as additional information for the individual websites. 

1. Consent management tool
Some data processing (e.g. IP address) is technically necessary to display the requested content, others serve to improve the usability or needs-based design of our offers and are only processed if you actively consent to this.
To obtain and manage the necessary consents in accordance with Section 25 (1) TTDSG and, if applicable, Art. 6 (1) sentence 1 lit. a GDPR, we use a so-called consent management tool, which appears when the website is accessed for the first time and can be accessed at any time via a link in the footer of the website. The legal basis for the use of the consent management tool is the fulfillment of our legal obligation pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR.
Detailed information on the subject and scope of data processing by cookies and similar technologies (insight tags, pixels) as well as the respective legal basis will be provided to you directly via the consent management tool on the respective website.

2. Contacting Instone

a) Newsletter
If you contact us via the contact form to receive our newsletter, your details from the form, including the contact details you provide there, will be stored by us for the purpose of sending you the newsletter. We cannot send you a newsletter without this data. We process the following personal data: Name, title and e-mail address on the basis of your consent (Art. 6 para. 1 lit. a GDPR). The data you enter in the form will remain with us until you ask us to delete it or revoke your consent. You can unsubscribe from our newsletter at any time, i.e. revoke your consent, for example via the "Unsubscribe" link in the newsletter or by sending a message to the e-mail address datenschutzteam@instone.de.

We can also send a newsletter to existing customers on the basis of our legitimate interest in providing information about our services in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR and Section 7 para. 3 UWG. You can object to receiving this newsletter at any time, for example by clicking on the "Unsubscribe" link in the newsletter or by sending a message to the following email address datenschutzteam@instone.de.

b) Contact and interest form
If you use the contact form to send us an expression of interest in a particular project or documents, your details from the form, including the contact details you provide there, will be stored by us for the purpose of processing the request and in the event of follow-up questions. We cannot process your request without this data. We process at least the data marked as mandatory fields on the basis of Art. 6 para. 1 lit. b GDPR. Without this information, it is unfortunately not possible for us to advise you. The data you enter in the form will remain with us until the purpose for data storage no longer applies (e.g. after your inquiry has been processed). If you purchase a property, we are legally obliged to store your data for ten years from the conclusion of the contract.

3. Applications
You can apply for positions at Instone Group via a career portal at https://www.instone-group.de.

We process your personal data to the extent that this is necessary for the decision on establishing an employment relationship with us. The legal basis for this is Art. 6 Para. 1 lit. b GDPR and Art. 88 GDPR in conjunction with Section 26 of the new BDSG for the initiation or implementation of contractual relationships. We can also process your personal data if this is necessary to fulfill legal obligations (Art. 6 Para. 1 lit. c GDPR) or to defend against legal claims asserted against us. The legal basis for this is Art. 6 Para. 1 lit. f GDPR. The legitimate interest is, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).

If you give us your express consent to process personal data for certain purposes, the legality of this processing is based on your consent in accordance with Art. 6 Para. 1 lit. a GDPR. Consent granted can be revoked at any time, with effect for the future (see VI Rights of the data subject, 6. Right to revoke consent, Art. 7 Para. 3 GDPR). If an employment relationship arises between you and us, we can, in accordance with Art. 6 Para. 1 lit. b GDPR and Art. 88 GDPR in conjunction with Section 26 of the new BDSG, further process the personal data already received from you for the purposes of the employment relationship, insofar as this is necessary for the implementation or termination of the employment relationship or for the exercise or fulfillment of the rights and obligations of the employee interest representation arising from a law or a working agreement. We only process data that is related to your application. This can be general data about you (name, address, contact details, etc.), information about your professional qualifications and school education, information about professional training and, if applicable, other data that you send to us in connection with your application.

We process personal data that we receive from you by post or email when you contact us or submit your application, or that you send to us via various sources. You also have the option of registering with our career portal and creating an account. In doing so, we process certain personal data that can be used to determine your identity. We process your personal data in the portal so that you can create an account on the portal, set up a profile and/or apply for a job. We would also like to notify you of new job vacancies and send you information about career opportunities. The legal basis on which we are permitted to process your personal data in the career portal continues to be the legal basis stated in Section 1 in the Applications section. We also pass on your personal data to other companies in the Instone Real Estate Group, but only to the departments and persons who need this data to fulfill contractual and legal obligations or to implement our legitimate interests. We store your personal data as long as this is necessary to decide on your application. Your personal data or application documents will be deleted a maximum of six (6) months after the end of the application process (e.g. the announcement of the rejection decision), unless longer storage is legally required or permitted. We can also store your personal data for longer if you have given us your consent to do so. We only store your personal data if this is required by law or in the specific case to assert, exercise or defend legal claims for the duration of a legal dispute. If an employment relationship, training relationship or internship relationship arises following the application process, your data will initially continue to be stored if necessary and permitted and then transferred to the personnel file.

Customer portal

The Instone Group operates various customer portals where you can register or log in if you already have an account with us. Please refer to the imprint of the respective website to find out which INSTONE company is responsible.

We process your personal data for the following purposes:

- When you contact us as part of the purchase of a property, as part of the construction process or all other concerns, e.g. via telephone, e-mail or contact form
- To arrange appointments (e.g. special request advice, inspections, acceptance/handover)
- To carry out the (digital) sampling of the purchase object
- To provide you with your contract documents
- To provide you with information about the project/construction progress
- You can also exchange files with us via our portal

The legal basis for the aforementioned purposes is Art. 6 Para. 1 lit. b GDPR. We process your personal data to initiate or fulfill the contract.

We also process your personal data on the basis of our legitimate interest in accordance with Art. 6 Para. 1 lit. f GDPR to offer you the opportunity to advertise and recommend our services to friends and acquaintances. This data processing serves to promote our business success through targeted customer acquisition and the strengthening of our customer relationships.

Use of Microsoft Bookings

For your appointment bookings, we also use Microsoft Bookings, a service of the Microsoft 365 package, which is provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Your name, email address, the booked service and any other data that you optionally provide to us (telephone number, address, additional comments) are transferred to Microsoft Bookings so that we know which appointment you have booked and so that Microsoft Bookings can send you an appointment confirmation. The processing is carried out for the purpose of fulfilling the contract in accordance with Art. 6 Para. 1 lit. b) GDPR. Personal data that you transmit to Microsoft Bookings is generally stored within the EU. However, we cannot completely rule out the possibility that Microsoft Ireland Operations Ltd. will transmit personal data to the USA. In order to ensure compliance with data protection, we have concluded a data processing agreement with Microsoft Ireland Operations Ltd. and agreed on additional security measures for the transmission of personal data to third countries. For more information about data processing by Microsoft, please see the Microsoft Privacy Information, available at HTTPS://PRIVACY.MICROSOFT.COM/EN-US/PRIVACYSTATEMENT.

II. Social Media

1. X (formerly Twitter )
We have a presence on the social network X, formerly Twitter (twitter.com), which is operated by X Corp, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (hereinafter "X"). Please note that we have no influence whatsoever on data processing by X, which may also take place outside the EEA. For the purpose and scope of the data collection, the further processing and use of the data by the provider X and your rights and setting options for protecting your privacy, please refer to the information on data protection from X at https://twitter.com/privacy. 

3. LinkedIn
We maintain a presence on the social network LinkedIn (linkedin.com), which is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter "LinkedIn"). For the purpose and scope of the data collection, the further processing and use of the data by the provider LinkedIn and your rights in this regard and setting options to protect your privacy, please refer to LinkedIn's data protection information at https://de.linkedin.com/legal/privacy-policy?. 

3. Xing
We have a presence on the social network Xing (Xing.com), which is operated by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany (hereinafter "Xing"). The purpose and scope of the data collection, the further processing and use of the data by the provider Xing and your rights and setting options for protecting your privacy in this regard can be found in Xing's data protection information at https://www.new-work.se/de/datenschutz. 

4. Instagram
We have a presence on the social network Instagram (instagram.com), which is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter "Meta"). For the purpose and scope of the data collection, the further processing and use of the data by the provider Meta and your rights in this regard and setting options for protecting your privacy, please refer to Instagram's data protection information at https://www.facebook.com/privacy/explanation.

5. Facebook
We have a presence on the social network Facebook (facebook.com), which is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter "Meta"). For the purpose and scope of the data collection, the further processing and use of the data by the provider Meta and your rights in this regard and setting options for protecting your privacy, please refer to Instagram's data protection information at https://www.facebook.com/privacy/explanation.