Privacy Notice

3.              Processing of Personal Data; Purposes of Processing

a)              Informational Use of the Website

When you use the Website purely for informational purposes, i.e., if you do not actively provide us with information, we generally do not collect any personal data, except for the data that your browser automatically transmits to enable you to visit the Website. This includes, for example:

• IP address;
• Date and time of access;
• Amount of data transferred each time;
• Identification data of the browser used;

We generally do not associate this data with specific individuals. The aforementioned processing of data is generally carried out only for the purpose of enabling the use of the Website (establishing a connection; technical session control). To the extent that the processing of the aforementioned data constitutes personal data, the corresponding processing of this data is based on Article 6(1)(f) of the GDPR (legitimate interest; the legitimate interest arises from the aforementioned purpose – enabling the offering and access of the Website).

b)              Contact

If you contact us (e.g., by email or via the contact form on the Website), the data you provide in this context will be used to process your inquiry. In the case of contact by email, this includes, in particular:

• Name
• Email address
• Content of the message

The aforementioned data are generally used for the purpose of processing the respective contact request.

The legal basis for the processing of the aforementioned personal data is – depending on the individual case – either Article 6(1)(b) of the GDPR (contract or pre-contractual measures), Article 6(1)(f) of the GDPR (legitimate interests; the legitimate interest arises from the fact that only through the corresponding processing of the data can the action desired by the user (e.g., answering inquiries) be carried out), or Article 6(1)(a) of the GDPR (consent).

c)              Newsletter

If you sign up for a newsletter (on our Website), we process the data provided in this context (in particular, email addresses) to send you the corresponding newsletters. The legal basis for the related processing of personal data is Article 6(1)(a) of the GDPR (consent). See also the further explanations below regarding Mailchimp.

d)              Booking Tool

If a booking process for a desired accommodation is carried out via the booking mask on the Website (“Booking Tool”), the data transmitted by the user in this context will be used to process the request. This includes, for example, the following data:

• Name
• Email address
• desired accomodation

The aforementioned data are generally used for the purpose of processing the respective booking request, in particular to initiate a contract with the respective landlord of the desired accommodation.

The processing of the aforementioned data in the context of a booking process by MILESTONE regarding a specific accommodation is carried out by MILESTONE as a processor (Article 28 GDPR, data processing) (the respective landlord is the data controller in this respect). Separate information on the data processing for which the respective landlord is responsible can be found in the respective privacy notices of the landlord, which are accessible via a link in the booking process on the Website.

e)              Use of Cookies and Other Tools

i)                General

We may use cookies on the Website. Cookies are small text files that are stored in the browser’s memory.

When accessing individual pages of the Website, we may use so-called technically necessary cookies to navigate the Website, use basic functions, and ensure the security of the Website; these cookies do not collect information about you for marketing purposes nor do they store which web pages you have visited. The legal basis for the use of these technically necessary cookies is Article 6(1)(f) of the GDPR (legitimate interest; the legitimate interest arises from the purposes mentioned above, in particular session control and ensuring the security of the Website).

To the extent that we use other, non-technically necessary cookies or comparable non-technically necessary technologies (see, for example, below regarding Google Analytics) in relation to your visit to the Website, we will always obtain your consent in advance (via a consent management tool – for more information: Borlabs – Premium Plugins for WordPress) on the Website. If you do not give such consent, such cookies and technologies will not be used in relation to your visit to the Website. The legal basis for the processing of (personal) data associated with such cookies and technologies is Article 6(1)(a) of the GDPR (consent).

Common browsers can usually be configured so that no cookies are stored. However, disabling cookies may result in not being able to use all functions of our Website (completely or without disruption)

ii)              Google

• Google Analytics

The Website uses Google Analytics, a web analytics service provided by Google. If you do not consent to the use of this tool when you first access the Website, no personal data will be processed with the help of this tool. Through this service, we can evaluate the use of our Website and collect information about the needs of users to improve the user-friendliness and quality of our online offering. To carry out these evaluations, aggregated and anonymous or pseudonymized (statistical) data are collected. Google Analytics uses, among other things, so-called “cookies,” which are files stored on your system that enable an analysis of your use of the Website.

The information generated by such cookies or other technologies used by Google Analytics about your use of the Website may also be transferred to and processed on servers of Google in the USA. However, your IP address is generally shortened beforehand. On behalf of the operator of this Website, Google will use the information processed by the tool to evaluate your use of the Website, to compile reports on Website activities, and to provide other services related to Website and internet use to the Website operator.

You can prevent the storage of the corresponding cookies by adjusting your browser software accordingly. Furthermore, you can deactivate the use of Google Analytics regarding our Website with respect to your personal data in the included on our Website.

Additional information about Google Analytics can be found here: https://support.google.com/analytics/answer/6004245?hl=de#zippy=

• YouTube

We may embed YouTube videos from the online video platform “YouTube” provided by Google on the Website, which are stored on YouTube servers and can be played directly from our Website. We use this tool to present certain video content to our users. If you do not consent to the use of this tool when you first access the Website, no personal data will be processed with the help of or in connection with this tool.

The data protection mode, meaning that personal data about you as a user are only transmitted to YouTube if you play the videos. We have no influence on this data transmission. This data transmission occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google at the same time, your data will be directly associated with your account. YouTube stores your data, possibly as usage profiles, and uses them for purposes such as advertising, market research, and/or tailoring YouTube offerings to your needs.

You can deactivate the use of YouTube regarding our Website with respect to your personal data in the consent management tool (for more information: Borlabs – Premium Plugins for WordPress) included on our Website.

In connection with the data processing described above, processing may also take place in the USA (see below under (d)).

• Google Maps

We may use “Google Maps” provided by Google on this Website. If you do not consent to the use of this tool when you first access the Website, no personal data will be processed with the help of or in connection with this tool. Each time “Google Maps” is accessed, Google sets a cookie to process user settings and data for the purpose of ensuring functionality and improving the Maps functions by Google when displaying the page on which “Google Maps” is integrated. This cookie is generally not deleted by closing the browser but expires after a certain period unless you delete it manually beforehand. You can also deactivate the use of Google Maps regarding our Website with respect to your personal data in the consent management tool (for more information: Borlabs – Premium Plugins for WordPress) included on our Website. However, we point out that if you deactivate it, you may not be able to use Google Maps (on our Website) or only to a limited extent.

• Further Information about Google

The legal basis for the processing of (personal) data by us in connection with the tools mentioned under section 3e)ii) is Article 6(1)(a) of the GDPR (consent).

The responsible service provider for the tools mentioned under section 3e)ii) is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

As already described above, data may also be processed by Google in the USA. Regarding the USA, there is currently a (limited) adequacy decision by the EU Commission; Google LLC has certified itself accordingly in relation to this decision. In addition, standard data protection clauses within the meaning of Article 46(2)(c) of the GDPR may be used additionally (by Google) (corresponding documentation on the standard data protection clauses can be provided to you by Google in this case).

See also the information from Google on data protection at: https://www.google.de/intl/de/policies/privacy

iii)            Mailchimp

We use the “Mailchimp” service provided by The Rocket Science Group LLC (675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA) in connection with sending newsletters (see above) to provide you with requested newsletters. In connection with the use of the tool, data (e.g., email addresses) may be processed outside the EEA (e.g., in the USA), with the provider acting as a processor (Article 28 GDPR).

Regarding the USA, there is currently a (limited) adequacy decision by the EU Commission; The Rocket Science Group LLC is certified accordingly in relation to this decision. In addition, standard data protection clauses within the meaning of Article 46(2)(c) of the GDPR may be used additionally (corresponding documentation on the standard data protection clauses can be provided to you by The Rocket Science Group LLC in this case).

iv)            Microsoft Clarity

The Website uses Microsoft Clarity, a service provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland). If you do not consent to the use of this tool when you first access the Website, no personal data will be processed with the help of this tool. The tool is used to analyze user behavior on our Website by collecting information about the Website visit. This helps to improve the user experience and adapt the Website to the needs of users.

The information generated by Microsoft Clarity about your use of the Website may also be transferred to and processed on servers of Microsoft in the USA.

You can prevent the storage of the corresponding cookies by adjusting your browser software accordingly. Furthermore, you can deactivate the use of Microsoft Clarity regarding your personal data in the consent (for more information: Borlabs – Premium Plugins for WordPress) included on our Website.

The legal basis for the processing of (personal) data described above in connection with Microsoft Clarity is Article 6(1)(a) of the GDPR (consent).

Additional information from Microsoft can be found here: https://learn-microsoft-com.translate.goog/en-us/clarity/faq?_x_tr_sl=en&_x_tr_tl=de&_x_tr_hl=de&_x_tr_pto=rq

As already described above, data may also be processed by Microsoft in the USA. Regarding the USA, there is currently a (limited) adequacy decision by the EU Commission; Microsoft Corporation has certified itself accordingly in relation to this decision. In addition, standard data protection clauses within the meaning of Article 46(2)(c) of the GDPR may be used additionally (by Microsoft) (corresponding documentation on the standard data protection clauses can be provided to you by Microsoft in this case).

v)              Giraffe 360

We may use the Giraffe360 service on this Website, which is offered by Giraffe360 Limited (9th Floor 107 Cheapside, London, United Kingdom

We use Giraffe360 to show you a 360-degree tour of property offers on our Website. When you visit one of our pages equipped with an immoviewer 3D tour on the Website, a connection to the servers of the provider of this tool is established, provided that you have previously consented to the processing of corresponding data. In this process, the date and time of the page access, the accessed page or the name of the retrieved file, the amount of data transferred, and the message whether the access/retrieval was successful are recorded.

The legal basis for the processing of personal data in connection with Giraffe360 is Article 6(1)(a) of the GDPR, with the service provider acting as a processor for us (Article 28 GDPR).

As already described above, data may be processed by the provider in the United Kingdom. Regarding the United Kingdom, there is currently an adequacy decision by the EU Commission.

f)               Social-Media Profiles

• We maintain social media profile pages on the following social networks:
• Instagram (Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland);
• LinkedIn (Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
• Facebook (Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland); and
• TikTok (Provider: TikTok Technology Limited, Ropemaker Place, Dublin 2, Ireland
• Visiting our respective profile pages may trigger certain data processing operations. Below, we provide you with an overview of the corresponding processing of personal data that occurs when you visit our profile pages. You are not obliged to provide us with personal data in this context. However, this may be necessary for individual functionalities of our respective profile pages. These functionalities may not be available to you or only to a limited extent if certain data are not shared or processed.
• When you visit our profiles, your personal data are processed not only by us but often also by the operators of the respective social network. This may also happen if you do not have a profile on the respective social network. The individual data processing operations and their scope differ depending on the operator of the respective social network. For details on the processing of your personal data and the type, scope, and purpose of their use by the operator of the respective social network, please also refer to the privacy notices of the respective operator
• The privacy notices regarding Instagram can be viewed at https://privacycenter.instagram.com/policy.
• privacy notices regarding Facebook can be viewed at https://de-de.facebook.com/privacy/policy
• the privacy notices regarding TikTok can be viewed at: https://www.tiktok.com/legal/page/eea/privacy-policy/de
• The privacy notices regarding LinkedIn can be viewed at: https://de.linkedin.com/legal/privacy-policy?
• We process your personal data in connection with our profile pages, in particular for advertising our products and services and for communicating with interested parties or customers. The legal basis for this is – depending on the individual case – either Article 6(1)(f) of the GDPR (legitimate interests, for example, if you contact us on a platform, we have a legitimate interest in answering your inquiry), Article 6(1)(b) of the GDPR (contract or pre-contractual measures), or Article 6(1)(a) of the GDPR (consent).
• In some cases, we may act as joint controllers (Article 26 GDPR) with the respective operator of the social network regarding certain processing activities. For example, regarding Facebook, we may be jointly responsible with Meta to a certain extent for the processing of so-called “Insights data,” insofar as the processed data are used for creating so-called “Page Insights.” In this case, Meta and we have concluded an agreement within the framework of joint controllership, which can be found on Meta’s websites. In this case, you can, for example, assert your data subject rights (information, etc.) directly against Meta.
• In addition to the aforementioned processing regarding Insights data, we are generally solely responsible for any further processing by ourselves (for example, if you contact us via Facebook and we process your data to answer your inquiry outside of Instagram).
• Regarding any third-country processing (outside the EEA) by the aforementioned social networks, we suggest that you review the privacy notices of the respective providers of these networks mentioned above.

4.              Disclosure of Personal Data to Third Parties

Personal data processed by us as the sole controller will generally not be disclosed to third parties without your consent or otherwise transmitted to third parties, subject to other cases described in this Privacy Notice.

Exceptions to this are transmissions of personal data in the case of a legal disclosure obligation (e.g., to government institutions and authorities), insofar as we are legally obliged to do so. The legal basis for these processing of your personal data is Article 6(1)(c) of the GDPR (fulfillment of a legal obligation).

We may use (external / technical) service providers who process personal data on our behalf. These service providers process the data exclusively according to our instructions (Article 28 GDPR, data processing).

The personal data collected in the context of the Booking Tool regarding a specific accommodation are processed by us as (sub-)processors for and on behalf of the respective landlord of the desired accommodation (Article 28 GDPR, data processing; see also above) and shared with them to a certain extent (see above). In this context, we also share data with the respective (affiliated) Milestone (management) company, which acts as the manager and/or service provider of the landlord or supportively in relation to the properties offered on the Website, certain data – in particular for the purpose of initiating, executing, and terminating (specific) (rental) contracts. Regarding rentals in the respective countries, this concerns the following companies: Italy: MILESTONE Management SERVICES IT S.R.L.; Netherlands: Milestone Management Services NL B.V.; Portugal: MILESTONE Management SERVICES PT, UNIPESSOAL LDA; Germany: MILESTONE Immobilien-Verwaltungs GmbH; Poland: MILESTONE Management SERVICES PL Sp. zo. o.

5.              Duration of Retention of Personal Data

Unless a different retention period arises from the other provisions of this Privacy Notice and the information in the consent management tool (for more information: Borlabs – Premium Plugins for WordPress), we generally store your personal data obtained by us in connection with the use of the Website as the controller only as long as necessary to fulfill the respective processing purpose, thereafter only to the extent and insofar as we are obliged to do so due to legal retention obligations; insofar as we no longer need your data for the purposes described above, they will only be stored during the respective legal retention period and not processed for other purposes.

6.              Recipients Outside the EE

We may disclose personal data as the data controller to third parties located in countries outside the European Economic Area (“EEA“) (in particular in the cases expressly described in this Privacy Notice). In this case, we generally ensure before disclosure that an adequate level of data protection exists with respect to the respective recipient or that the corresponding third-country transfer complies with the requirements of the GDPR (see in particular Articles 44 et seq. of the GDPR).

An adequate level of data protection exists, for example, if the European Commission has adopted a so-called adequacy decision for the respective country (Article 45 GDPR) and its conditions are met. For example, for the USA, the European Commission has decided that an adequate level of data protection exists there if the data recipient is certified under the so-called EU-U.S. Data Privacy Framework (DPF). Therefore, if the recipients of personal data are located in the USA and are accordingly DPF-certified, we generally rely on this adequacy decision.

In some cases, an adequate level of data protection may also be established by using so-called EU standard data protection clauses of the European Commission (Article 46(2)(c) GDPR).

7.              Your Rights

You have the right to request information from us about the personal data stored by us about you that we process as the controller. If the legal requirements are met, you also have the right to rectification, deletion, or restriction of processing of the corresponding personal data, the right to object to the processing of your personal data by us, and the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format from us.

If you have given consent to the use of personal data, you can revoke it at any time (for the future).

If you believe that the processing of personal data concerning you by us violates applicable data protection law, you can complain to the (competent) supervisory authority for data protection.

For any rights of data subjects in relation to data processing for which not we, but the respective landlord is responsible (see above), the data subject can contact the respective landlord directly.

8.              Data Security

We maintain up-to-date technical measures to ensure data security, in particular to protect your personal data from risks during data transmissions and from third parties gaining knowledge. These are adjusted according to the current state of the art.

9.              Amendment of the Privacy Notice

We reserve the right to change the Privacy Notice from time to time. We therefore recommend that you read this Privacy Notice again at regular intervals.