Privacy notice
Information pursuant to Art. 13 GDPR on the processing of personal data on this platform.
Contents
The German version is authoritative.
1. Controller
The controller responsible for processing personal data on this platform is AVW Immobilien AG, Rothenburgsorter Marktplatz 1, 20539 Hamburg, Germany, telephone +49 40 790246-0, email info@avw-ag.de. Further details are given in the legal notice.
2. Data protection officer
The data protection officer of AVW Immobilien AG can be contacted at datenschutz.hamburg@mazars.de.
3. The platform
“Project Keystone” is a protected area in which AVW Immobilien AG provides information and documents to selected persons. Only authorised persons are granted access. This notice explains which data are processed in the process.
4. Sign-in by email link
To sign in, you enter your email address. If it is authorised, we send you a personal sign-in link. It is valid for 20 minutes and can be used once; on the server it is stored only as an irreversible check value. The link starts a session of no more than 12 hours.
In doing so, we process your email address, your name, organisation and language setting from your account, the times of the request, the sign-in and the last activity, the requested target page, your IP address and, at sign-in, your browser identifier (user agent).
If an address that is not authorised is entered or too many links are requested, we store the address entered together with the time and IP address in order to detect misuse. The sign-in page responds identically in all cases.
5. Accounts, groups and permissions
For each account we store the name, email address, organisation, language setting, group membership and the resulting permissions, as well as the times of creation and of the last sign-in.
Administrators can view the platform as a group or person in order to check permissions. No further data are collected in the process; every change of view is logged.
6. Logging
To protect the confidential content and to be able to trace access, we log the use of the platform:
- sign-ins and sign-outs, requests for sign-in links, invalid links and denied access;
- page views with the time during which a page is actively displayed;
- interactions such as opened chapters and statements, search terms and progress when watching videos, as well as viewing and downloading documents and exports;
- the creation and modification of comments, tasks, saved calculations and entries, and changes made by administrators.
Each entry records the time, the action, the page or document concerned, the IP address and a shortened identifier of your browser. In the log entries, the person is replaced by a pseudonym; the entries are protected against subsequent modification. Only administrators can attribute entries to an account and analyse the logs.
7. Comments, tasks and saved entries
If you create comments or tasks, we store the content, your name as author, the times, the selected group and, where applicable, the responsible person and the due date. They are visible only to the members of the selected group and to administrators. The same applies to calculations and entries you save on the platform.
9. Maps
For location maps, your browser loads map tiles from OpenFreeMap (Hyperknot Software Kft., Hungary), delivered via the Cloudflare network (Cloudflare, Inc., USA). In the process, your IP address and the requested map sections are transmitted, but no other data from the platform. Our interest lies in showing the location of properties and projects.
10. Recipients: operation, hosting and email delivery
The platform is operated by an IT service provider on behalf of AVW Immobilien AG. The data centre operator is Hetzner Online GmbH, Gunzenhausen, Germany; the servers are located in Finland (Helsinki). The database is backed up daily; backups are kept on the server for 14 days and stored in encrypted form in storage provided by Hetzner Online GmbH in Germany (Falkenstein).
Sign-in links are sent by the email service Resend (Plus Five Five, Inc., San Francisco, USA). In the process, your name, your email address and the sign-in link are transmitted.
Within the platform, administrators can see accounts and logs. We only transfer data to other third parties if we are legally obliged to do so.
11. Transfers to the USA
When sign-in links are sent and when maps are displayed, data may be transferred to the USA. Resend and Cloudflare are certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR) and, for email delivery, additionally on standard contractual clauses (Art. 46(2)(c) GDPR).
12. Legal bases
We process the data described on the basis of Art. 6(1)(f) GDPR. Our legitimate interests lie in providing confidential information and documents securely and only to authorised persons, in being able to trace access and detect misuse, in enabling collaboration on the platform and in showing the location of properties and projects on maps.
13. Storage period
Sign-in links become invalid after 20 minutes or on first use, sessions after no more than 12 hours or on sign-out. We delete the records of expired or ended sign-in links and sessions, including IP address and browser identifier, 90 days after they expire.
We delete log entries after twelve months. Entries concerning addresses that are not authorised or were requested too often, which contain an entered e-mail address and an IP address, are deleted after 90 days. Calculations that you delete on the platform are removed permanently after 30 days.
At the end of the project for which the platform is provided, we lock all accounts except those of administrators. Six months later we delete these accounts together with all log entries, comments, tasks and saved calculations accumulated up to that point.
The cookies for language and colour scheme are valid for one year. The database is backed up daily; backups remain on the server for 14 days. In the encrypted backup storage we keep daily backups for 30 days and monthly backups for six months. Deleted data may be contained in backups until these periods expire and for up to ten further days for which the backup storage keeps snapshots; it is used from there only to restore operation after an outage.
Longer storage takes place only where statutory retention obligations apply or the data are required for the establishment, exercise or defence of legal claims, and only for as long as this is necessary.
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and, where applicable, data portability (Art. 20). Please contact us using the details given above.
Right to object under Art. 21 GDPR
You may object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Without processing sign-in and access data, the platform cannot be used.
15. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for AVW Immobilien AG is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.
16. Provision of data and automated decisions
You are under no statutory or contractual obligation to provide data. Without your email address, however, it is not possible to sign in. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.