Our Handling of Your Data and Your Rights

Information pursuant to Articles 13, 14 and 21 of the EU General Data Protection Regulation (GDPR)

Information Notice

With the following information, we would like to give you an overview of how we process your personal data and your resulting rights. The specific data processed and how it is used depends primarily on the services requested or agreed upon and whether you are a tenant, employee, service provider, or otherwise related to a tenant. Therefore, not all statements contained herein may apply to you.

Furthermore, this data protection information may be updated from time to time.

The current version is dated May 2026.

Who is responsible for data processing and whom can I contact?

The data controller within the meaning of the GDPR is:

You can reach our company data protection officer at:

Type of personal data collected

We process the following personal data that we receive from you or the tenant in the course of our business relationship. This includes, for example:

• Company name with legal form and address
• Title and name
• Telephone numbers
• Fax numbers
• E-Mail addresses
• Area of activity or position
• Information about your inquiry, including metadata
• Bank details
• Data collected for credit checks

We process your data for the following purposes and on the following legal basis:

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG):

To fulfil contractual obligations, Art. 6 para. 1 lit. b GDPR

Processing is necessary for the performance of a contract with you or the relevant tenant.

Due to legal requirements, Art. 6 para. 1 lit. c GDPR

We are subject to various legal obligations that necessitate data processing. These include, for example:

• Tax laws and statutory accounting requirements
• Fulfilling requests and requirements from supervisory or law enforcement authorities
• Fulfilling tax-related control and reporting obligations

Furthermore, the disclosure of personal data may be necessary in the context of official/judicial proceedings for the purposes of gathering evidence, criminal prosecution, or enforcement of civil claims.

In accordance with the balancing of interests, Art. 6 para. 1 lit. f GDPR

Where necessary, we process your data beyond the actual performance of the contract to protect our legitimate interests or those of third parties. Examples of such cases include:

• Assertion of legal claims and defense in legal disputes
• Storage of additional contact persons for communication purposes
• Video recordings

Who receives my data?

Within our company

• Employees who contact you and handle contractual matters, including fulfilling pre-contractual obligations.

This includes your personal data, which may be stored in service tickets submitted via the support hotline.

In the context of commissioned data processing

Your data will only be shared with service providers, data processors, if this is necessary for the fulfilment of our contractual obligations. Recipients of personal data may include, for example:

• Support and maintenance of IT systems or applications
• Service providers providing technical support for the organization and execution of rental agreements
• Accounting
• Data destruction
• Tradespeople, caterers, and other third parties required for the execution of the rental agreement

All service providers are contractually bound and, in particular, obligated to treat your data confidentially.

Other third parties

Data will only be transferred to recipients outside our company in compliance with applicable data protection regulations. Recipients of personal data may include, for example:

• Public authorities and institutions, e.g., tax or law enforcement agencies, when there is a legal or official obligation to disclose the data
• Credit and financial service providers, processing payments
• Tax advisors or auditors, statutory audit mandate
• Tradespeople, service providers, experts, and the landlord's building and liability insurers

Will data be transferred to a third country or an international organization?

Your data will only be processed within the European Union and countries within the European Economic Area (EEA).

How long will my data be stored?

We process and store your personal data for as long as necessary to fulfil our contractual and legal obligations. If the data is no longer required to fulfil contractual or legal obligations, it will be routinely deleted.

Exceptions apply:

• where statutory retention obligations must be fulfilled, e.g., under the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention or documentation periods stipulated therein are generally six to ten years;
• for the preservation of evidence within the framework of the statutory limitation periods. According to Sections 195 et seq. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the standard limitation period being three years.

If data processing is carried out in our legitimate interest or that of a third party, the personal data will be deleted as soon as this interest no longer exists. The aforementioned exceptions apply. If you have given your consent, we will retain your data until you withdraw it.

What data protection rights do I have?

You have the right to:

• information under Article 15 GDPR,
• rectification under Article 16 GDPR,
• erasure under Article 17 GDPR,
• restriction of processing under Article 18 GDPR,
• object under Article 21 GDPR,
• data portability under Article 20 GDPR.

The right to information and the right to erasure may be subject to restrictions under Sections 34 and 35 of the German Federal Data Protection Act (BDSG).

Furthermore, you have the right to lodge a complaint with a competent data protection supervisory authority, Article 77 GDPR in conjunction with Section 19 BDSG.

The supervisory authority responsible for us is:

Is there an obligation to provide data?

Within the framework of the contractual relationship, you must provide the personal data that is necessary for the establishment, execution, and termination of the contractual relationship and for fulfilling the associated contractual obligations, or which we are legally obligated to collect. Without this data, we will generally be unable to conclude or perform the contract with you.

Information about your right to object under Article 21 of the General Data Protection Regulation (GDPR)

Right to object in individual cases

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR (processing based on legitimate interests); this also applies to profiling based on those provisions as defined in Article 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.

Recipient of the objection

The objection can be submitted informally with the subject line "Objection," stating your name, address and, if applicable, your tenant, and should be sent to: Datenschutz@panavia.de