Data protection information for visitors to the TAG websites

TAG Information for visitors and users of TAG websites regarding the processing of personal data on the websites of TAG companies and the use of website services (cookies, etc.)

The following information explains what happens to your personal data when you visit a website of TAG Immobilien AG (hereinafter also referred to as "TAG") or the website of a company belonging to the TAG Group. This information is intended for users of the websites of TAG Immobilien AG, TAG Wohnen & Service GmbH (hereinafter also referred to as "TAG Wohnen"), Bau-Verein zu Hamburg Hausverwaltungsgesellschaft mbH (hereinafter referred to as "Bau-Verein") and Trinom Business Apartments (hereinafter also referred to as "TRINOM"). TAG Wohnen and Bau-Verein each have supplementary data protection information specifically aimed at their target groups and customers (tenants and owners, respectively). Anyone wishing to obtain comprehensive information about data protection within the TAG Group can also access this data protection information at tag-wohnen.de and bau-verein.de.
We take the protection of your personal data very seriously and treat your data confidentially and in accordance with legal requirements. Personal data is any data that can be used to identify you personally. In addition, we refer to the TAG Terms of Use, which contain further regulations on the use of the websites.

1. Who is responsible for data collection on the TAG websites and who can I contact?
The responsible body is TAG Immobilien AG, Steckelhörn 5, 20457 Hamburg, which is the operator and controller of this website.

Please address any questions you may have about data protection to:
TAG Immobilien AG
Data Protection Management
Kreuzstraße 7 c, 04103 Leipzig
Email: datenschutz(at)tag-ag.com

TAG Immobilien AG has appointed the following external data protection officer:
DOMUS Consult Wirtschaftsberatungsgesellschaft mbH
Schornsteinfegergasse 13, 14482 Potsdam-Babelsberg
Telephone: 0331 743 30-0
Email: datenschutz(at)tag-ag.com

These contact details for TAG Wohnen also apply to all companies affiliated with TAG Immobilien AG (hereinafter referred to as "TAG") under company law, i.e. all companies belonging to the TAG Group.

2. How is my personal data processed via the company's website?
a. If you use the website for informational purposes only, i.e. if you do not log in, register or otherwise provide us with information on the website, we do not collect any personal data, with the exception of the data transmitted by your browser to enable you to visit the website. This includes, among other things, the date and time of access, IP address, Internet service provider, browser type and version, URL of the referring website and websites accessed. These server log data are stored separately from other data and do not allow any identification of a specific person. The aforementioned data is not merged with other data sources.

b. This data collected via a web interface serves the purpose of enabling you to visit the website, ensuring the error-free provision of the website and improving the website. This data is therefore processed for the technical administration of the website, to analyse your user behaviour and to initiate and implement pre-contractual measures, and is thus based on Article 6(1)(b) and (f) of the GDPR.

c. This data collected via a web interface is transmitted exclusively via encrypted connections. If you use the contact form we provide to send us an enquiry or to get in touch, this system uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise this by the fact that the address line of your browser changes from "http://" to "https://" and by the lock symbol in your browser line. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

3. What are cookies and are they used on the websites?
When using the company's website, cookies are used to ensure the smooth technical operation of the website, to make the Internet offering more user-friendly, effective and secure, and to analyse user behaviour. Cookies are small text files that are assigned to and stored on your hard drive by the browser you are using and through which certain information flows to the entity that sets the cookie. Cookies cannot execute programmes or transfer viruses to your computer. This website uses transient cookies (temporary use), persistent cookies (time-limited use), third-party cookies (from third-party providers) and Flash cookies (possibly from third-party providers).

Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies. These store a so-called session ID, which can be used to assign various queries from your browser to the shared session. This allows your computer to be recognised when you return to the website. Session cookies are deleted when you log out or close your browser.

Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time in your browser's security settings.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies in certain cases or in general, and activate the automatic deletion of cookies when you close your browser. However, if you deactivate cookies, the functionality of this website may be restricted.

Cookies that are necessary for the electronic communication process to provide certain functions are stored on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in storing them in order to ensure the technically error-free and optimised provision of our services. This also applies to the analysis of your user behaviour.

4. Which website services are used?
a. Google Analytics
This website uses functions of the web analysis service Google Analytics, a web analysis service provided by Google Inc. (hereinafter: "Google"). The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Technically, the information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, your IP address will be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You may refuse the use of cookies by selecting the appropriate settings on your browser software; however, please note that if you do this, you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available under the following link (http://tools.google.com/dlpage/gaoptout?hl=de). This will set an opt-out cookie that prevents the future collection of your data when you visit this website and thus deactivates Google Analytics.

Further information on terms of use and data protection can be found at
http://www.google.com/analytics/terms/de.html or at http://www.google.com/intl/de/analytics/privacyoverview.html. In addition, we would like to point out that on this website, Google Analytics has been extended by the code "gat._anonymizeIp();" to ensure anonymous collection of IP addresses (so-called IP masking).

Google Analytics cookies are stored on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in analysing user behaviour in order to optimise both our website and our advertising.

b. Google Analytics Remarketing
Our website uses the Google Analytics Remarketing function in conjunction with the cross-device functions of Google AdWords and Google DoubleClick. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This feature allows us to link the advertising audiences created with Google Analytics Remarketing to the cross-device features of Google AdWords and Google DoubleClick. In this way, interest-based, personalised advertising messages that have been tailored to you based on your previous usage and surfing behaviour on one device can also be displayed on another of your devices. If you have given your consent, Google will link your web and app browsing history to your Google account for this purpose. This allows the same personalised advertising messages to be displayed on every device you log into with your Google account. To support this feature, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to our Google Analytics data to define and create target groups for cross-device advertising. You can permanently opt out of cross-device remarketing/targeting by disabling personalised advertising in your Google account; to do so, follow this link:
https://www.google.com/settings/ads/onweb/.

c. Google Ads and Google Conversion Tracking
This website uses Google Ads, an online advertising programme from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google").

We use conversion tracking as part of Google Ads. When you click on an ad placed by Google, a conversion tracking cookie is set. Cookies are small text files that the internet browser stores on the user's computer. These cookies expire after 30 days and are not used to personally identify users. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the ad and was redirected to this page.

Each Google Ads customer receives a different cookie. Cookies cannot be tracked across the websites of Ads customers. The information collected using the conversion cookie is used to generate conversion statistics for Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. If you do not wish to participate in tracking, you can object to this use by easily deactivating the Google conversion tracking cookie via your internet browser under user settings. You will then not be included in the conversion tracking statistics.

The storage of "conversion cookies" is based on Art. 6 para. 1 lit. f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising.

For more information about Google Ads and Google conversion tracking, please refer to Google's privacy policy: https://www.google.de/policies/privacy.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If you deactivate cookies, the functionality of this website may be restricted.

d. Mapbox
This site uses a map service called Mapbox via an API. The provider is Mapbox Inc., 740 15th St NW, Washington DC 20005, USA.

To use the functions of Mapbox, it is necessary to store your IP address. This information is usually transferred to a Mapbox server in the USA and stored there. The provider of this site has no influence on this data transfer.

Mapbox is used in the interest of an appealing presentation of our online offerings and to make it easy to find the locations we have indicated on the website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f) GDPR.

For more information on the handling of user data, please refer to Mapbox's privacy policy: https://www.mapbox.com/privacy.

e. YouTube
Our website uses plugins from the Google-operated site YouTube. The operator of the site is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

When you visit one of our pages equipped with a YouTube plugin, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited.

If you are logged into your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account. YouTube is used in the interest of an appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

Further information on the handling of user data can be found in YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy.

f. Facebook Pixel
Our website uses the visitor action pixel from Facebook, Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook") to measure conversion.

This allows the behaviour of page visitors to be tracked after they have been redirected to the provider's website by clicking on a Facebook advertisement. This allows the effectiveness of Facebook advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimised.

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook Data Use Policy. This enables Facebook to place advertisements on Facebook pages and outside of Facebook. As the website operator, we have no influence on this use of the data.

You can find further information on the protection of your privacy in Facebook's privacy policy: https://www.facebook.com/about/privacy/.

You can also deactivate the "Custom Audiences" remarketing function in the ad settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do this, you must be logged in to Facebook.

If you do not have a Facebook account, you can deactivate usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: https://www.youronlinechoices.com/de/praferenzmanagement/.

g. Social media
This website uses elements from social media (e.g. Facebook, Instagram).

You can usually recognise the social media elements by the respective social media logos. To ensure data protection on this website, we only use these elements in conjunction with the so-called "Shariff" solution. This application prevents the social media elements integrated on this website from transferring your personal data to the respective provider when you first visit the site.

Only when you activate the respective social media element by clicking on the corresponding button will a direct connection to the provider's server be established (consent). As soon as you activate the social media element, the respective provider receives the information that you have visited this website with your IP address. If you are logged into your respective social media account (e.g. Facebook, Instagram) at the same time, the respective provider can assign the visit to this website to your user account.

Activating the plugin constitutes consent within the meaning of Art. 6 (1) lit. a GDPR and § 25 (1) TTDSG. You can revoke this consent at any time with effect for the future.

The service is used to obtain the legally required consent for the use of certain technologies. The legal basis for this is Art. 6 (1) lit. c GDPR.

Facebook
Elements of the Facebook social network are integrated into this website. This service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected is also transferred to the USA and other third countries.

An overview of Facebook social media elements can be found here: https://developers.facebook.com/docs/plugins/?locale=de_DE.
When the social media element is active, a direct connection is established between your device and the Facebook server. Facebook receives the information that you have visited this website with your IP address. If you click the Facebook "Like" button while you are logged into your Facebook account, you can link the content of this website to your Facebook profile. This allows Facebook to associate your visit to this website with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or its use by Facebook. For more information, please see Facebook's privacy policy at: https://de-de.facebook.com/privacy/explanation.

If consent has been obtained, the use of the above-mentioned service is based on Art. 6 (1) lit. a GDPR and § 25 TTDSG. Consent can be revoked at any time at . If no consent has been obtained, the use of the service is based on our legitimate interest in achieving the widest possible visibility on social media.

If personal data is collected on our website using the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Article 26 GDPR). Joint responsibility is limited exclusively to the collection of data and its transfer to Facebook. The processing by Facebook after the transfer is not part of the joint responsibility. The obligations incumbent upon us jointly have been set out in a joint processing agreement. The wording of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing data protection information when using the Facebook tool and for the data protection-compliant implementation of the tool on our website. Facebook is responsible for the data security of Facebook products. You can assert your rights as a data subject (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert your rights as a data subject with us, we are obliged to forward them to Facebook.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php.

Instagram
This website incorporates features of the Instagram service. These features are offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When the social media element is active, a direct connection is established between your device and the Instagram server. Instagram thereby receives information about your visit to this website.

If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking on the Instagram button. This allows Instagram to associate your visit to this website with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the data transmitted or its use by Instagram.

If consent has been obtained, the use of the above-mentioned service is based on Art. 6 (1) lit. a GDPR and § 25 TTDSG. Consent can be revoked at any time. If no consent has been obtained, the use of the service is based on our legitimate interest in achieving the widest possible visibility on social media.

If personal data is collected on our website using the tool described here and forwarded to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Article 26 GDPR). Joint responsibility is limited exclusively to the collection of data and its transfer to Facebook or Instagram. The processing by Facebook or Instagram after the transfer is not part of the joint responsibility. The obligations incumbent upon us jointly have been set out in a joint processing agreement. The wording of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing data protection information when using the Facebook or Instagram tool and for the secure implementation of the tool on our website in accordance with data protection law. Facebook is responsible for the data security of Facebook or Instagram products. You can assert your rights as a data subject (e.g. requests for information) regarding the data processed by Facebook or Instagram directly with Facebook. If you assert your rights as a data subject with us, we are obliged to forward them to Facebook.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.

Further information can be found in Instagram's privacy policy: https://instagram.com/about/legal/privacy/.

h. Chat and voice bot
No personal data is required to use the chat and voice bot (hereinafter also referred to as "bot") for general enquiries. However, you may still enter or provide personal data when using the bot. We use your data exclusively to respond to your enquiry. If we store the enquiry internally for improvement purposes, we will delete your personal data beforehand. When using the bot for matters relating to rental agreements, personal data is processed. For more information, please refer to the data protection notice for tenants and prospective tenants at www.tag-wohnen.de/datenschutz.
We do not transfer your data to third parties unless this is necessary to respond to your bot enquiry. The use and processing of your data is based on legal provisions that justify processing on the grounds that it is necessary to respond to your enquiry. We only store your data for as long as is necessary to fulfil your request or for as long as is necessary to comply with statutory retention obligations.

i. Timify
Our website uses the TIMIFY account to provide an appointment booking solution. The provider of this system is TerminApp GmbH, Balanstr. 73, 81541 Munich.

When you use the online appointment booking system on our website, the data you enter in the booking form is transmitted to TerminApp GmbH. The information you provide will be processed exclusively for the purpose of providing our contractual services and will, of course, be treated confidentially.

The transfer of your data to TerminApp GmbH is based on Art. 6 (1) (a) GDPR (consent) and Art. 6 (1) (b) GDPR (processing for the performance of a contract). You have the option to revoke your consent to data processing at any time. A revocation does not affect the validity of past data processing operations. We have concluded a contract with TerminApp GmbH for commissioned data processing.

Further information on how user data is handled by the appointment booking solution on our website can be found at https://www.timify.com/de-de/legal/.

5. What rights do I have as a visitor to the website?
Every data subject has the right to information under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. The restrictions of Sections 34 and 35 of the Federal Data Protection Act (BDSG) apply to the right to information and the right to erasure insofar as personal data has been stored separately on TAG's servers. This means that the right to erasure is limited to the restriction of the processing of personal data, as TAG is obliged to ensure its automated data processing security systems (backups) and the erasure of personal data in these systems would involve an unreasonable and disproportionate effort. Finally, there is a right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG).

You can revoke your consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent that were given to us before the GDPR came into force, i.e. before 25 May 2018. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected.

The assertion of these data protection rights and, in particular, the assertion of revocation must be made by email to
datenschutz(at)tag-ag.com

or in writing by post to the data protection management department
TAG Immobilien AG
Data Protection Management
Kreuzstraße 7 c, 04103 Leipzig

The assertion of rights is free of charge.

For further information, please refer to the options described in this notice for objecting to the setting of cookies and the use of service providers, and for technically excluding them from your browser.

6. Is my data passed on to third parties or to a third country, and on what basis does this take place?
Our data processing may involve the transfer of personal data to third countries (countries outside the European Union or the GDPR) through the use of third-party services (e.g. subcontractors of processors, cloud services, etc.). Such transfers are permitted if the European Commission has determined that an adequate level of data protection is provided in such a third country. If no such adequacy decision has been made by the European Commission, personal data will only be transferred to a third country if the conditions set out in Articles 44 to 49 of the GDPR are met. In particular, the following will be checked:
a) The existence of an adequacy decision by the EU Commission establishing an adequate level of data protection for third countries or specific sectors or certified companies in third countries (Article 45 GDPR)
b) the existence of contractual obligations in accordance with the EU Commission's standard contractual clauses (Art. 46 GDPR),
c) The existence of binding internal data protection rules (Art. 47 GDPR),
d) Exceptions for specific cases (Art. 49 GDPR).
For further information about the respective service providers and guarantees for the protection of your data, you can contact our company using the contact details provided in this information.

7. Your personal data will not be passed on to third parties within the sole use of the website, with the exception of the anonymised IP address and the use of website service providers, as described here, and will not be passed on outside the EU.

Insofar as IP addresses are passed on to third parties in anonymised form, TAG has concluded data processing agreements – where required. Only when you have contacted us via the contact form will your personal data be further collected and processed/passed on within the Group. You have agreed to this before accessing the contact form.

8. Other information
As a rule, no further transfer of personal data to countries outside the EEA (European Economic Area) or to an international organisation takes place. In the context of remote maintenance of standard IT components, it cannot be ruled out that, in individual cases, an IT service provider from a third country (e.g. the USA) may, in rare cases, be granted controlled and limited access to personal data for the purpose of troubleshooting.

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

Hamburg, September 2025
TAG Immobilien AG
TAG Wohnen & Service GmbH