Information to be provided pursuant to Art. 13 of the General Data Protection Regulation (GDPR) when personal data are collected from the data subject

The controller’s contact information

Controller (per Art. 4 No. 7 GDPR)

ISARIA Wohnbau AG
Leopoldstraße 8
80802 Munich
Phone: +49 89 38 99 84-0
Fax: +49 89 38 99 84-790
E-mail: info@isaria.ag
Web: www.isaria.ag

Data protection officer’s contact information

Data protection officer

Leopoldstraße 8
80802 Munich
Phone: +49 89 38 99 84-231
Fax: +49 89 38 99 84-790
E-mail: datenschutz@isaria.ag
Web: http://www.isaria.ag/

Purposes of and legal bases for data processing

Intended purpose

Sale and marketing of goods and services specific to real estate

Lawfulness of the processing, Art. 6 GDPR

  • Consent
  • Contract, contract initiation, contractual performance
  • Fulfillment of a legal obligation
  • Protection of legitimate interests of the controller or of a third party
  • Other (provisions of law)

Necessity and proportionality, Art. 5 GDPR







Source of the data

The lawfulness of data processing is determined according to the following principles:

“Proportionality” (Art. 5(1) lit. b), “transparency” (Art. 5(1) lit. a), “data minimization” (Art. 5(1) lit. c), “accuracy” (Art. 5(1) lit. d), “storage limitation” (Art. 5(1) lit. e) and “integrity and confidentiality” (Art. 5(1) lit. f) and according to the principle of “restriction to purpose” (Art. 5(1) lit. b).

Contract, contractual performance or contract initiation with the data subject
Consent of the data subject
Overriding provisions of law

Recipients or categories of recipients of personal data

Internal recipients
(within the controller)



External recipients and third parties
(all other recipients, including those in group companies, if not processors)

Recipients within the controller and all internal entities involved in the communication necessary to achieve the stated purpose:
e.g. purchasing, sales, accounting, processors, cooperating partners, service providers

External entities involved in communication, public entities that receive the data on the basis of provisions of law, and third parties who are not processors:
e.g. contractors, cooperating partners, group companies, suppliers, service providers, banks, auditors, tax consultants, financial authorities

Transfer of personal data to a third country

Non-Member States/international organizations

Data transfer neither takes place nor is planned

Duration of storage of personal data

Storage period

The legal requirements applicable to the various preservation periods (under commercial and tax law) are complied with.
Data are deleted when they are no longer relevant to business operations.

Rights of data subjects

Right of access, Art. 15 GDPR

If your personal data are being processed, then you have the right to information concerning the data pertaining to your person that have been stored.

Right to rectification, Art. 16 GDPR

Should personal information be processed that is inaccurate, you have the right to have that information corrected.

Right to erasure, right to limit processing, Art. 17 and 18 GDPR

Subject to certain legal conditions, you have the right to have your data erased and to limit the processing of your data.

Right to data portability, Art. 20 GDPR

If you have consented to data processing or there exists a contract for data processing and the data processing is performed with the aid of automated processes, then you have a right to data portability.

Right to object, Art. 21 GDPR

You have the right to object at any time to the processing of your personal data.

Right to lodge a complaint with a supervisory authority, Art. 77 GDPR

You have the right to lodge a complaint with a competent supervisory authority (in the Member State in which you have your customary place of residence).

Right to revocation, § 51 BDSG (new)

If the processing of your personal data is based on Art. 6(1) a) or Art. 9 a), then you have the right to revoke your consent at any time. Your revocation will not affect the lawfulness of the processing that occurred on the basis of your consent before that consent was revoked.

Duty to provide data

For the purposes of our business relationship, you must provide those personal data that are necessary for the initiation and conduct of a business relationship or performance of the associated contractual duties or that we are required by law to collect. If we lack these data, we usually must decline to enter into a contract with you or to carry out an order, or we will no longer be able to perform, or may be compelled to terminate, an existing contract.

Change of purpose

No change of purpose is planned.