Data Protection Notice

Below, we, PBG – Parkhaus Betriebsgesellschaft mbH, Niddastraße 7, 60329 Frankfurt am Main, would like to provide you with comprehensive and detailed information about how we protect your privacy and how personal data is processed in connection with our services (in particular the letting of parking space for short-term and long-term parking), our websites and/or online offerings.
Should the information below be insufficient or unclear in any respect, please do not hesitate to contact us using the contact details given in Section II.

Below you will find information on (i) the name and contact details of the controller, (ii) the contact details of the Data Protection Officer, and (iii) the contact details of the supervisory authority responsible for us, to whom you may address any complaints:

Controller

PBG – Parkhaus Betriebsgesellschaft mbH
Niddastraße 7
60329 Frankfurt am Main

Data Protection Officer

ABG Frankfurt Holding AG
Email: datenschutzbeauftragter@abg.de

Supervisory Authority

The Hessian Commissioner for Data Protection and Freedom of Information
P.O. Box 3163
65021 Wiesbaden
Germany
Tel.: +49 611 1408-0

Email: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de/

The terms and definitions used in this privacy notice are based on Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or “GDPR”), as well as the German Federal Data Protection Act in the version applicable from 25 May 2018 (“BDSG”). In particular, the definitions set out in Art. 4 and Art. 9 GDPR apply.

Please note that the GDPR and the BDSG only apply to the processing of personal data relating to natural persons. As a general rule, data protection law does not apply to data relating to legal entities (e.g. a GmbH, AG, or cooperative), unless natural persons acting as sole traders are affected, a so-called one-person GmbH is involved, or personal data relating to the employees of a legal entity is processed.

1.   Scope of the processing of personal data

As a general rule, we only collect and use the personal data of our contractual partners or users (in particular short-term and long-term parkers) to the extent necessary to provide and deliver our services and to provide our websites or online offerings (including mobile apps), or where another legal basis permits the collection and/or use of personal data for other purposes.

2.   Legal bases

Where personal data is processed on the basis of the consent of the data subject, Art. 6(1)(a) GDPR is the legal basis for the processing.

Where personal data is processed in order to perform a contract to which the data subject is party, Art. 6(1)(b) GDPR is the legal basis; this also applies to processing required to carry out pre-contractual measures.

Where the processing of personal data is necessary to comply with a legal obligation to which we are subject, Art. 6(1)(c) GDPR is the legal basis. Where the vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR is the legal basis.

Where processing is carried out to protect a legitimate interest of our company or a third party, and provided that the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR is the legal basis for the processing.

Where personal data is processed in connection with a so-called change of purpose, i.e. where the data is to be used for purposes other than those for which it was originally collected, Art. 6(4) GDPR is the legal basis.

Where special categories of personal data within the meaning of Art. 9 GDPR are processed, the legal basis for the processing is the explicit consent of the data subject pursuant to Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR and/or one of the permitted grounds under Art. 9(2)(b)–(j) GDPR.

3.   Processing to enforce claims / comply with legal obligations

We reserve the right to process personal data for the purpose of enforcing claims on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR; this also includes the disclosure of data to credit reference agencies (see Section VI.8), authorities and/or courts. Data may likewise be processed and/or disclosed for the purpose of complying with statutory or legal obligations (e.g. providing information to authorities); the legal basis for this is Art. 6(1)(c) GDPR.

4.   Obtaining consent / right of withdrawal

Consent under Art. 6(1)(a) GDPR is generally obtained in writing or electronically. In the case of electronic consent, this may be given by ticking the relevant opt-in box. The content of the consent declaration is documented electronically. Where consent is given electronically, the so-called double opt-in procedure is used to identify the user, insofar as this is legally required.

Right of withdrawal: Please note that consent, once given, may be withdrawn at any time with effect for the future – either in full or in part; the lawfulness of any processing carried out on the basis of the consent up to the point of withdrawal remains unaffected. Please send any withdrawal to the contact details given in Section II (the controller or the Data Protection Officer).

5.   Possible recipients of personal data

First of all, we would like to point out that, as a general rule, only those persons and bodies that require access to fulfil the purposes described have access to personal data (the so-called “need-to-know” principle). This means that the group of persons with access is limited to those employees who absolutely require it in order to fulfil the relevant processing purpose.

To provide the services agreed with the data subject (including websites and/or online offerings), we also engage service providers in some cases who act on our behalf and in accordance with our instructions when providing these services (processors). In the course of providing these services, such service providers may receive personal data or come into contact with personal data and constitute third parties or recipients within the meaning of the GDPR.

In such cases, we ensure that our service providers offer sufficient guarantees that appropriate technical and organisational measures are in place and that processing is carried out in a manner that complies with the requirements of the GDPR and ensures the protection of the rights of the data subject (cf. Art. 28 GDPR).

Where personal data is disclosed to third parties and/or recipients outside the context of a processing arrangement, we ensure that this takes place exclusively in accordance with the statutory requirements (GDPR, BDSG) and only where an appropriate legal basis exists (e.g. Art. 6(4) GDPR; see otherwise Section IV.2). Where personal data is disclosed, or is intended to be disclosed, to third parties outside the context of a processing arrangement, this is expressly stated below. Data is disclosed, for example, in connection with payment transactions (e.g. to banks or payment service providers).

6.   Possible processing of data in so-called third countries

As a general rule, your personal data is processed within the EU or the European Economic Area (“EEA”). Only in exceptional cases (e.g. in connection with the engagement of service providers for web analytics services) may information be transferred to so-called “third countries”. “Third countries” are countries outside the European Union and/or the Agreement on the European Economic Area in which an adequate level of data protection corresponding to EU standards cannot readily be assumed.

Where the information transferred also includes personal data, we ensure, prior to any such transfer, that an adequate level of data protection is guaranteed in the relevant third country or on the part of the relevant recipient in that third country, or that you have given your consent to the transfer, or that another permitted ground applies (e.g. Art. 49 GDPR). An adequate level of data protection may be established by means of a so-called “adequacy decision” of the European Commission, through the use of the so-called “EU Standard Contractual Clauses”, or by other measures within the meaning of Art. 44 et seq. GDPR. Where personal data is processed, or is intended to be processed, in third countries, this is expressly stated below.

7.   Data deletion and storage period

Personal data relating to data subjects is deleted once it is no longer required for the relevant processing purposes. Deletion may instead be replaced by restriction of processing where this is provided for by European or national legislators in EU regulations, laws or other provisions to which our company is subject, in particular:

• in order to comply with statutory retention obligations (e.g. under the German Fiscal Code (AO) or the German Commercial Code (HGB)), currently ranging from 6 to 10 years,
• and/or where there is a legitimate interest in storage (e.g. for the duration of limitation periods for the purpose of any legal defence (Sections 195 et seq. of the German Civil Code (BGB)), currently ranging from 3 to 30 years).

Data is deleted at the latest once a retention period prescribed by the aforementioned rules expires, unless there is a continuing need to store the data for the conclusion of a contract or for other purposes. The legal basis for storing your data within the aforementioned limits is Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (legitimate interests); where data is stored for the duration of limitation periods, our legitimate interest lies in our legal defence.

8.   Data subject rights

The GDPR grants data subjects extensive rights (so-called data subject rights, in particular Art. 12 to Art. 22 GDPR). The individual data subject rights are explained in more detail in Section XIII. Should you wish to exercise one or more of these rights, you may contact us at any time. Please use the contact options given in Section II for this purpose.

With regard to the type of personal data processed, we essentially distinguish between (i) master data, (ii) contract performance data and (iii) third-party data. In addition, special categories of personal data within the meaning of Art. 9 GDPR may also be processed.

1.   Master data

Master data is data relating to your company and/or you as an individual that you provide in the course of entering into contractual negotiations and/or concluding a contract. This data results from the contractual forms we use in each case and, in particular, contains details such as company name, surname, first name, address, date of birth, email address, telephone number, fax number, and, for billing purposes, bank account details. In the case of long-term parking arrangements, the official vehicle registration number of the authorised vehicle may also form part of the master data. In addition, you may voluntarily provide us with further data or preferences as part of your application. We collectively refer to this data provided by you as “master data”.

2.   Contract performance data

Contract performance data is data that arises in the course of contract performance and is processed by us for the purposes of contract performance, billing, administration, further development or marketing of our offerings and services. Depending on the services commissioned, contract performance data may in particular include: the vehicle registration number recorded on entry, the times of entry and exit, the resulting calculated parking duration, parking space or site data, parking ticket data, booking and reservation data, payment and billing data, and video recordings relating to entry and exit (see Section VI.3 and Section IX).

3.   Third-party data

Third-party data is personal data that we do not collect directly from you, or that has not been provided by you, but which we receive from third-party companies and/or contractual partners, for example in the context of separate contractual relationships. Such third-party data relating to your company / you as an individual may, for example, include address data of third parties, billing data of third parties, vehicle keeper information, details of alternative payers, or details of other persons authorised to use the service (e.g. in the case of long-term parking contracts covering several authorised vehicles), or similar information.

1.   Entering into and performing contracts for the letting of parking space

We process personal data in order to establish, perform, administer and terminate rental and usage arrangements for parking space. This concerns, in particular, the short-term provision of parking spaces (short-term parking) as well as longer-term parking space, garage and long-term parking arrangements (long-term parking).

In this context, we process, in particular, master data, contract performance data and third-party data (see Section V). Data required for entering into contractual negotiations, concluding, performing or terminating a parking contract, including the fulfilment of related obligations, is mandatory and is marked as such in our contract or enquiry forms. Without this data, it may not be possible to conclude a contract – particularly in the area of long-term parking – or we may have to decline to conclude a contract if such data is not provided.

2.   Purposes of the data processing

The processing is carried out, in particular, for the following purposes:

• entering into contractual negotiations for, concluding and performing the parking contract (short-term and long-term parking);
• recording entry and exit and calculating the parking or rental duration as the basis for calculating the fee (see, in particular, the following section on registration number recording (Section VI.3) and Section IX);
• billing for the parking duration and processing payment transactions (e.g. via payment machines, barrier systems, online payment services, or by direct debit in the case of long-term parking contracts);
• administering and operating the car parks and parking spaces, including handling enquiries, faults, and damage or defect reports;
• communicating with contractual partners and authorised users;
• debt/claims management and the assertion, exercise and defence of legal claims (e.g. in the event of non-payment of the parking fee, breaches of contract, or damage to the car parks or to third-party vehicles);
• ensuring the safety of car park operations and the protection of property, and protecting against vandalism (see also Section IX);
• complying with statutory and legal obligations.
  

3.   Recording of registration numbers on entry for calculating parking duration

In order to perform the parking contract and calculate the parking or rental duration, we record the official registration number of your vehicle when it enters the car park. This is done using video-based number plate recognition (capturing the vehicle registration number on entry and exit). The parking duration, which forms the basis for calculating the parking fee, is determined by comparing the data recorded on entry and on exit. In the case of long-term parking, the comparison of registration numbers is also used to verify entry or usage authorisation.

In this context, we process, in particular, the vehicle registration number, the recordings taken on entry and exit, the times of entry and exit, and the parking duration calculated from this data.

The legal basis for recording registration numbers for the purpose of performing the contract and calculating the fee is Art. 6(1)(b) GDPR (performance of the parking contract or the carrying out of pre-contractual measures). In the alternative – in particular with regard to passengers or other persons who are not themselves party to the contract, and for the purposes of access and authorisation control and ensuring proper car park operations – we base the processing on Art. 6(1)(f) GDPR (legitimate interests); our legitimate interest lies in the accurate recording and billing of parking transactions and in ensuring smooth, abuse-free car park operations.

4.   Categories of personal data

In connection with the letting of parking space, depending on the contractual and usage relationship, we process, in particular, the following categories of personal data:

• vehicle registration numbers and the video recordings made on entry and exit;
• parking and usage data (times of entry and exit, calculated parking duration, parking space/site data, parking ticket, booking and reservation data);
• payment and billing data (e.g. bank details, data relating to the payment method used, invoice and receipt data);
• contractual master data (in particular, in the case of long-term parking contracts: name, address, contact details, company details where applicable, and the authorised registration number(s));
• communication data (e.g. the content of your enquiries, correspondence, and damage or defect reports).
  

5.   Legal bases

The legal basis for the processing described above in connection with entering into contractual negotiations, performing the contract and billing is Art. 6(1)(b) GDPR. Where the processing serves to comply with statutory obligations (e.g. the retention of billing documents under commercial and tax law), the legal basis is Art. 6(1)(c) GDPR. Where the processing serves to protect legitimate interests (e.g. ensuring proper car park operations, access and authorisation control, debt/claims management, and the assertion and defence of claims), the legal basis is Art. 6(1)(f) GDPR.

6.   Categories of recipients

Recipients of your personal data in connection with the letting of parking space are, in the first instance, the relevant internal departments of the controller that require this data for contract performance, billing, customer support or the operation of the car parks. In addition, the following categories of recipients may be involved, in each case to the extent necessary:

• IT and software service providers, as well as operators of the parking, payment and barrier systems used (as processors under Art. 28 GDPR);
• payment service providers, banks, and debt collection service providers, in connection with the processing of payment transactions and debt/claims management;
• security and surveillance service providers, and operators or maintenance providers of the video surveillance systems;
• lawyers, tax advisers, auditors, and courts, insofar as this is necessary for the assertion, exercise or defence of legal claims;
• authorities, investigative and law enforcement agencies, insofar as there is a statutory obligation to provide the information, or where this is necessary and permissible to protect legitimate interests.
  

7.   Storage period / deletion periods

Data collected in connection with the letting of parking space is deleted as soon as it is no longer required for the purposes stated. Billing and contractual data is stored for the duration of the contractual relationship and thereafter in accordance with the statutory retention periods (in particular under commercial and tax law, currently ranging from 6 to 10 years), as well as, on the basis of legitimate interests, for the duration of any limitation periods for the purpose of legal defence (see Section IV.7). Section IX applies in addition with regard to the storage period for video recordings made on entry and exit and for video surveillance data; as a general rule, such data is stored only for a short period and, other than the parking and billing data required for contract performance, is regularly deleted automatically, provided there is no security-relevant incident and no need to enforce or defend against claims.

8.   Processing of third-party data

In connection with contract performance, we may receive and process personal data relating to third parties (so-called third-party data) with whom we do not, in some cases, have a direct contractual relationship. Depending on the particular service relationship, this may include details of other authorised users, alternative payers (e.g. in the case of SEPA direct debit), authorised representatives, vehicle keepers, or vehicle drivers. The legal basis for this is contract performance (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR) and/or legitimate interests (Art. 6(1)(f) GDPR); our legitimate interests generally lie in the knowledge of third parties involved in the contractual relationship, which is required for the proper performance of the contract. After the relevant contractual relationships have ended, we retain this (third-party) data subject to a restriction on processing within the limits set out in Section IV.7.

9.   Processing of data relating to suppliers / service providers

We process personal data of suppliers and/or service providers (collectively referred to below as “suppliers”) who are natural persons and whose services we request and/or use on a contractual basis (e.g. maintenance of car park, payment and barrier technology, cleaning, and security services) for the purpose of performing the contract. This may involve master data and contract performance data.

The legal basis for such data processing is Art. 6(1)(b) GDPR (performance of the contract / carrying out of pre-contractual measures) and Art. 6(1)(a) GDPR (consent), insofar as you provide us with further documents. We reserve the right to process personal data of our suppliers for the purpose of enforcing claims on the basis of legitimate interests under Art. 6(1)(f) GDPR. Data may likewise be processed and/or disclosed for the purpose of complying with statutory or legal obligations (e.g. providing information to authorities); the legal basis for this is Art. 6(1)(c) GDPR.

Please note that data protection law may not apply to suppliers that are legal entities (cf. the definition of personal data in Art. 4(1) GDPR).

10. Processing of data to comply with statutory obligations

As a company, we are subject to various statutory obligations (e.g. tax legislation, the German Commercial Code, the German Anti-Money Laundering Act, and similar legislation) that require us to process your data in order to comply with statutory or legal obligations (e.g. providing information to authorities). The legal basis for this is Art. 6(1)(c) GDPR.

11. Digital signing of contracts (long-term parking)

For the conclusion or performance of long-term parking or parking space rental contracts, we also offer you the option of signing the contract, as well as other contract-related documents, digitally. For this purpose, we use a suitable signature service as a processor pursuant to Art. 28 GDPR.

As part of the digital signature process, we process, in particular, the following data: master data (e.g. name, address, contact details), contractual data (e.g. parking space, contract content, terms and conditions), technical data relating to the signature process (e.g. timestamp, IP address, signature hash, signature certificate data, technical log data), and communication data (e.g. emails sending invitations or confirmations).

The processing is based on Art. 6(1)(b) GDPR (carrying out pre-contractual measures and performing the contract) and Art. 6(1)(f) GDPR (legitimate interest in a secure, efficient and traceable signature process, in particular with regard to technical log and security data). Data collected in the course of the digital signature process is stored for the duration of the contractual relationship and thereafter in accordance with the statutory retention periods; signature logs are stored for as long as they are required as evidence of a legally valid signature (see also Section IV.7).

In our car parks, we use video technology for two distinct purposes: (1) to record entry and exit by means of number plate recognition for the purpose of contract performance and calculating the parking duration (see Section VI for details), and (2) for the general video surveillance of the car parks in order to protect property and possessions, to protect against vandalism and criminal damage, and to ensure general safety.

1. Recording of registration numbers on entry and exit

On entering the car park, the official registration number of your vehicle is recorded using video technology. This recording is used to determine the time of entry and, when compared with the time of exit, to calculate the parking or rental duration as the basis for calculating the fee, as well as, in the case of long-term parking, to verify entry or usage authorisation. The legal basis for this processing is Art. 6(1)(b) GDPR (performance of the parking contract), or in the alternative Art. 6(1)(f) GDPR (legitimate interest in the accurate billing of parking transactions and in effective access and authorisation control).

2.   General video surveillance in car parks

To protect against theft, assault, vandalism, criminal damage, harassment and similar incidents, and to ensure the safety of the persons, vehicles and facilities located in the car parks, we reserve the right to use a video surveillance system in our car parks (e.g. in entry and exit areas, driving lanes, at payment machines, and in stairwells and lift areas).

The legal basis for general video surveillance carried out by us as a non-public body is Art. 6(1)(f) GDPR (legitimate interests). Our legitimate interest lies in protecting our property and possessions, protecting the property of our customers and third parties, protecting against vandalism and criminal damage, ensuring the safety of persons present, and preventing and investigating criminal offences and securing evidence. Insofar as Section 4 of the BDSG (video surveillance of publicly accessible spaces) applies – notwithstanding the case law on the scope of this provision under EU law as it applies to non-public bodies – we additionally comply with the requirements set out therein.

We safeguard the interests, fundamental rights and freedoms of the persons affected by the video surveillance by limiting the surveillance to the extent necessary, drawing attention to the video surveillance by means of suitable notices before entering the monitored area (information obligations under Art. 13 GDPR), and subjecting the recordings to particularly restrictive access controls.

3.   Storage period / deletion periods

As a general rule, video recordings from the general video surveillance are stored only for a short period and are then regularly deleted automatically. In accordance with the principle of storage limitation (Art. 5(1)(e) GDPR), storage is generally limited to a maximum of 72 hours. Storage beyond this period only takes place in justified exceptional cases, in particular where a specific security-relevant incident (e.g. a criminal offence, an accident, or criminal damage) is identified, or where the recordings are required for the assertion, exercise or defence of legal claims. In such cases, we reserve the right to store and evaluate the relevant recordings beyond the aforementioned time window, to use them for the purpose of asserting or defending against claims, and to disclose them to investigative and law enforcement authorities for further investigation; they are deleted once they are no longer required for these purposes.

By contrast, the parking and billing data obtained through registration number recording is stored for the duration of contract performance and in accordance with the statutory retention and limitation periods (see Section VI and Section IV.7).

In our car parks, we use video technology for two distinct purposes: (1) to record entry and exit by means of number plate recognition for the purpose of contract performance and calculating the parking duration (see Section VI for details), and (2) for the general video surveillance of the car parks in order to protect property and possessions, to protect against vandalism and criminal damage, and to ensure general safety.

1.   Recording of registration numbers on entry and exit

1.   Newsletter

Where we offer a newsletter, or should we do so in future, we require a valid email address from you in order for you to use this service. To verify that you are the holder of the email address provided, or that its holder has agreed to receive the newsletter, we send an automated email to the address provided following the first registration step (so-called double opt-in). We only add the email address provided to our mailing list once the newsletter registration has been confirmed by means of a link in the confirmation email. Beyond the email address and the details required to confirm the registration, we do not collect any further data.

Your data is processed solely for the purpose of sending the newsletter you have requested. The legal basis for this processing is Art. 6(1)(a) GDPR. You may unsubscribe from the newsletter at any time; the explanations regarding the right to withdraw consent under Section IV.4 apply in addition.

2.   Use of personal data for advertising and marketing purposes / surveys

Personal data is used for the purposes of advertising and/or marketing communications, as well as for conducting customer satisfaction surveys (collectively referred to below as “marketing”), only where appropriate consent has been given or another legal basis exists that permits advertising and/or marketing communications even without consent:

• The legal basis for using master data for marketing purposes on the basis of express consent is Art. 6(1)(a) GDPR; the explanations regarding consent under Section IV.4 apply accordingly.
• The legal basis for using master data and third-party data (e.g. address data of third parties) for the purpose of direct marketing by post is Art. 6(1)(f) GDPR (legitimate interests).
• The legal basis for marketing by email for the purpose of direct advertising of our own similar goods or services is Section 7(3) of the German Act Against Unfair Competition (UWG); this requires that (i) we obtained your email address in connection with your registration or contractual relationship, (ii) you have not objected to the use of your email address for direct marketing purposes, and (iii) we clearly and expressly inform you, both when collecting the email address and on each occasion it is used, that you may object to such use of your email at any time (regarding the right to object, see Section XIII.6).
  

Personal data is stored and used for advertising / marketing purposes – depending on the relevant legal basis for the marketing measure (consent, legitimate interests, Section 7(3) UWG) – for an indefinite period, until you have objected to the use of your data for advertising / marketing purposes or have withdrawn your relevant consent. Section IV.4 otherwise applies accordingly.

3.   Press and public relations

For the purposes of press and public relations work, we reserve the right to collect and process master data, contract performance data or third-party data relating to journalists and/or press representatives. This may, in particular, include the provision of press information, the handling of press enquiries (e.g. via the relevant contact form), contacting press representatives, or organising and inviting individuals to (press) events. The legal basis for such data processing is Art. 6(1)(b) GDPR (performance of the contract / carrying out pre-contractual measures), insofar as this is done to fulfil a relevant agreement and/or in the context of a specific enquiry. Otherwise, the data processing is carried out on the basis of legitimate interests under Art. 6(1)(f) GDPR; our legitimate interest here lies in carrying out press and public relations work on behalf of PBG.

In connection with our services, our administrative and business processes, and our websites and online offerings, we use – insofar as this is necessary to provide and deliver our services or is covered by another legal basis – applications that are based on, or incorporate, so-called Artificial Intelligence (“AI”) methods (e.g. machine learning, language models, and automated text, speech and document processing).

As a general rule, we select AI applications in such a way that the use of our inputs, documents, transcripts or other processed data for training, fine-tuning, or improving the general AI models of the relevant provider is contractually excluded.

1.   General principles

We use AI-based applications solely as an aid or support tool. Final processing, assessment and decision-making always remain with the employees responsible; AI outputs are reviewed by our employees before use.

Insofar as applicable to the relevant use, we take into account the requirements of applicable data protection law, in particular the GDPR and the BDSG, as well as the requirements applicable to us under Regulation (EU) 2024/1689 laying down harmonised rules on Artificial Intelligence (the “AI Regulation” / “AI Act”).

When using AI, we process personal data in accordance with the principles of data minimisation, data avoidance, purpose limitation, accuracy, storage limitation, and integrity and confidentiality (Art. 5 GDPR).

2.   Purposes of the processing, categories of data affected

We use AI-based applications, in particular, for the following purposes:

• supporting the handling, research, analysis and preparation of facts, matters and legal questions;
• drafting, reviewing, summarising, translating and structuring letters, contracts and other documents (drafting support);
• reviewing, classifying, tagging and structuring documents and files (document and file management);
• organising, administering and optimising internal workflows and information and IT security;
• communicating with customers, users and other parties involved.

As a general rule, processing does not take place for purposes other than those described; any change of purpose is governed by Art. 6(4) GDPR.

In connection with the use of AI for support purposes, we may process, in particular, master data, contract performance data and third-party data (see Section V), contact data, content and factual data (including the content of letters, contracts, correspondence and other documents), communication data, and technical usage and log data.

Special categories of personal data within the meaning of Art. 9 GDPR, as well as particularly confidential content, are only processed within AI applications where this is necessary for the relevant purpose, an appropriate legal basis exists, and additional protective measures have been taken.

3.   Legal bases

Depending on the processing context, the legal basis for the processing of personal data using AI is:

• Art. 6(1)(b) GDPR, insofar as the processing is necessary for the performance of a contract to which you are party, or to carry out pre-contractual measures;
• Art. 6(1)(f) GDPR (legitimate interests), insofar as the processing serves the efficient, economical and quality-assured handling of matters, the organisation and optimisation of our workflows, and ensuring information and IT security, and provided that your interests, fundamental rights and freedoms do not override these interests;
• Art. 6(1)(c) GDPR, insofar as the processing is necessary to comply with a legal obligation;
• Art. 6(1)(a) GDPR (consent), insofar as we have obtained your consent.
  

Where, exceptionally, special categories of personal data within the meaning of Art. 9 GDPR are processed, the processing is based on a permitted ground under Art. 9(2) GDPR (where applicable, in conjunction with Section 22 BDSG) or on your explicit consent under Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR. In all other respects, the general explanations regarding data deletion and storage period apply (see Section IV.7).

4.   Transfer to third countries

As a general rule, the processing of personal data in connection with the use of AI takes place within the EU or the EEA. Where, in individual cases – for example, when engaging providers or sub-processors – personal data is transferred to a third country, this only takes place where an adequacy decision of the European Commission exists for the relevant third country, or where appropriate safeguards within the meaning of Art. 44 et seq. GDPR exist (in particular EU Standard Contractual Clauses together with supplementary technical and organisational measures), or where another permitted ground applies (e.g. Art. 49 GDPR).

5.   No automated decision-making in individual cases / no profiling

No decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) is made in connection with the use of the supporting AI applications. The AI applications used serve solely as a support tool; any legally significant assessment and decision is made by the employees responsible.

In order to provide websites, homepages and/or online offerings, personal data may be processed as follows, depending on the relevant website, homepage and/or online offering:

1.   Data processing for the provision of websites / collection of log files

Each time our websites and online offerings are accessed, our system automatically collects data and information from the computer system of the accessing device. In particular, the following data may be collected (referred to below as “log data”):

• information on the browser type and version used
• the operating system used by the user
• the user’s IP address
• the date and time of access
• the websites from which the user’s system accessed our website
• the websites accessed by the user’s system via our website
• the content of the request (the specific web page)
• the volume of data transferred, in bytes
• the user’s movements on our website (e.g. click rates, time spent on the site)
  

With the exception of the IP address, the log data referred to above does not allow a link to be established to the user as an identifiable person; such identifiability can only be established by linking or associating the log data with an IP address.

1.1.   Purpose and legal basis

Log data (in particular the IP address) is collected and processed for the purpose of providing the user with the content contained on our website, i.e. for the purpose of communication between the user and our website or online offering. The temporary storage of the IP address is required for the duration of the relevant communication process. The legal basis for this data processing – i.e. for the duration of your visit to the website / your use of it – is Art. 6(1)(b) GDPR or Section 25 of the German Telecommunications-Digital-Services-Data Protection Act (TDDDG).

Any processing and storage of the IP address in log files beyond the communication process is carried out for the purpose of ensuring the functionality of our websites and online offerings, optimising these offerings, and ensuring the security of our IT systems. The legal basis for this is Art. 6(1)(f) GDPR (protection of legitimate interests) or Section 169 of the German Telecommunications Act (TKG).

1.2.   Data deletion and storage period

Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected to provide the website, this is the case once the relevant session – the website visit – has ended. Log data, including the IP address, may be stored for a period of no more than seven days after the end of the page access for the purpose of system security. Processing and/or storage beyond this period is possible and permitted, provided that the IP addresses are deleted or altered in such a way, after the aforementioned period has expired, that it is no longer possible to link the log data to an IP address. This is subject to any further processing of data in the cases set out below (e.g. cookies, etc.).

1.3.   Right to object and possibility of removal

The collection of log data to provide the website, including its storage in log files within the aforementioned limits, is essential for the operation of the website. There is therefore no possibility for the user to object. This does not apply to the processing of log data for analysis purposes; this is governed by Section X.3, depending on the web analytics tool used and the type of data analysis (personal / anonymous / pseudonymous).

2.   Use of cookies

Our website uses cookies and other tracking technologies. Cookies are text files that are stored in, or by, the internet browser on the user’s computer system. Cookies do not contain any programs and cannot place any malicious code on your device. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again. Depending on the type of cookie in question and the possibility of linking a cookie to an IP address, it may be possible to establish a link to the user as an identifiable person. We do not make such a link, or IP addresses are anonymised in order to rule out such a link (see Section X.3 for details). Other tracking technologies may include web beacons, counting or tracking pixels, or similar technologies. Cookies and other tracking technologies are collectively referred to below as “cookies”.

For cookies that allow a link to be made to an identifiable person, we obtain your consent to such use via a so-called cookie banner (see Section X.2.1 below). Further information on cookies can also be found in our cookie notices, which you can access via our cookie banner.

We essentially distinguish between two types of cookies: (i) technically necessary or essential cookies, and (ii) cookies that require the user’s consent:

(i) We use technically necessary or essential cookies to make our website and/or online offering more user-friendly. Technically necessary cookies store and transmit the following data to our systems:

• adopting language settings
• remembering search terms, where applicable
• information on the device/computer used and its settings
• login information, where applicable

(ii) “Cookies requiring consent”, including so-called “functional cookies”, comprise all cookies whose setting or use requires the user’s prior consent. Such cookies may include convenience, statistics/analytics and/or advertising or marketing cookies. We distinguish between the following types of cookies that require consent:

• Functional or convenience cookies enable us to improve the convenience and user-friendliness of our websites and to provide various functions. For example, convenience cookies may be used to save search results, language, layout and/or screen settings.
• Performance cookies collect information about how you use our website. Performance cookies help us, for example, to identify particularly popular areas of our website. This allows us to tailor the content of our website more specifically to your needs and thereby improve our offering for you.
• Statistics or analytics cookies are used to analyse the browsing behaviour of users on our websites and/or online offerings for the purposes of advertising, market research, or designing our offerings to meet demand. Further information on this can be found in our cookie banners.

• Cookies for marketing purposes / third-party cookies are used by us to send you advertising information that is relevant to you, for example based on the websites you have visited. Advertising cookies are generally provided not by our web servers but by third-party providers. We are never able to search and/or evaluate third-party cookies. Responsibility for the use of such cookies lies solely with the third-party providers; we have no ability to influence their use and processing. You can prevent the setting of third-party cookies by means of the measures described in Section X.2.3 and Section X.3. If you do not allow these cookies, you will experience less targeted advertising.

An overview of all the providers we work with that use cookies – subject to any consent that may be required – can be found in our cookie settings.

2.1.   Purpose and legal basis

The purpose of using technically necessary cookies is to make it easier for users to use our website. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary for the browser to be recognised again even after navigating to a different page. We require technically necessary cookies for the following applications:

• adopting language settings
• remembering search terms, where applicable
• information on the device/computer used and its settings
• login information, where applicable

User data collected by technically necessary cookies is not used to create user profiles. The use of technically necessary cookies is based on Section 25(2) TDDDG, with further data processing based on Art. 6(1)(b) GDPR, insofar as the use of technically necessary cookies is required to provide our websites and/or online offerings for the purposes of contract performance, and otherwise on the basis of Art. 6(1)(f) GDPR, since the use also serves to protect legitimate interests in providing websites and/or online offerings.

The use of cookies requiring consent serves the purpose of improving the quality of our website, its content and/or its usability, and/or of carrying out analyses. Performance or analytics/statistics cookies enable us to find out how the website is used, allowing us to continuously optimise our offering and improve the usability of our website, for example through personalisation. Such cookies may be set by us or by third-party providers whose services we use on our pages. We have no influence over cookies set by third-party providers; their use, including the purposes and legal bases of the data processing, is governed exclusively by the data protection terms of those third-party providers. Further information can be found in our cookie notices.

Cookies requiring consent are, as a general rule, only set where the user has previously given the relevant consent to the use of such cookies (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG), including consent to any processing of data outside the EEA pursuant to Art. 49(1)(a) GDPR. Further information on cookies can also be found in our cookie notices, which you can access via our cookie banner.

2.2.   Data deletion and storage period

Cookies are stored on the user’s respective device (smart device/PC) and are transmitted from there to our websites. A distinction is made between so-called persistent cookies and session cookies. Session cookies are stored for the duration of a browser session and are deleted when the browser is closed. Persistent cookies are not deleted when the relevant browser session is closed, but are stored on the user’s device for a longer period.

2.3.   Right to object and possibility of removal

When our website is accessed, users are informed about the use of cookies by means of a cookie banner and referred to this privacy notice. The banner is also used to obtain the user’s consent to the processing of personal data used in this context, including consent to the processing of data outside the EEA pursuant to Art. 49(1)(a) GDPR.

As a user, you have full control over the use and storage of cookies. By changing the settings in your internet browser, you can generally disable or restrict the transmission of cookies. You can delete cookies that have already been stored at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all functions of the website to their full extent. Further information on the use of cookies can be found at http://www.meine-cookies.org/ or youronlinechoices.com.

You may object to, or withdraw your consent to, the use of cookies for which consent is required, at any time with effect for the future; you may exercise your right to object via the cookie banner or via the browser settings referred to above.

3.   Web analytics / use of analytics tools

In order to optimise our websites and adapt them to the changing habits and technical requirements of our users, we use so-called web analytics tools. In doing so, we measure, for example, which elements are visited by users and whether the information they are looking for can be found easily. This information only becomes interpretable and meaningful when a larger group of users is considered. For this purpose, the data collected is aggregated, i.e. combined into larger units.

This allows us to adapt the design of pages or optimise content if, for example, we find that a significant proportion of visitors use new technologies, or have difficulty finding, or cannot find, existing information.

On our websites and online offerings, we carry out the following analyses and/or use the following web analytics tools

3.1.   Analysis of log data

Insofar as we use log data for analysis purposes, this is done exclusively on an anonymous basis; in particular, there is no link to data relating to the user as an identifiable person and/or to an IP address or a cookie. Such analysis of log data is therefore not subject to the data protection provisions of the GDPR.

3.2.   Matomo

To analyse how our website is used, we use the web analytics service “Matomo”. This tool uses cookies that enable an analysis of how our tenants use the website on a pseudonymous and/or anonymous basis.

With Matomo, the usage information generated by the cookie is transferred to our server in Europe and stored for the purposes of usage analysis. The information generated by the cookie about your use of our website is not passed on to third parties.

If you do not wish cookies to be used and/or an evaluation to be carried out by Matomo, you have the following options: You can prevent data collection by Matomo by objecting to the use of web analytics tools via the banner or via the browser settings referred to above, thereby setting an opt-out cookie that prevents the future collection of your data by Matomo when you visit this website (however, in this case you may not be able to use all functions of this website to their full extent). If you have logged in to our website using your tenant details, this objection remains permanently stored.

Please note: if you delete your cookies, the opt-out cookie will also be deleted and may need to be reactivated by you.

The legal basis for the use of Matomo involving the use of cookies is Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG (consent); user consent is obtained via our cookie banner (see Section X.2) and can be withdrawn at any time via our cookie banner / cookie settings. Further information on data protection at Matomo can be found at https://matomo.org/privacy-policy/.

4.   Marketing / layout / map and social media integrations

Map and social media integrations may be used on our websites and online offerings.

Google Maps

Our website in some cases integrates map material from the Google Maps service provided by Google LLC via an API. In order to display the content in your browser, Google must receive your IP address. The legal basis for this data processing is Art. 6(1)(a) GDPR. We would point out that Google has its own privacy policy, which is independent of ours. Further information can be found at https://www.google.de/intl/de/policies/privacy/.

1.   Contact forms

Our website may contain contact forms that users can use to contact us electronically (e.g. for enquiries about long-term parking, fault and damage reports, and other enquiries). Depending on the relevant contact form, we collect, in particular, the following data in order to process your request:

• form of address, title, first name, surname
• street, house number, postcode, town/city
• telephone number, email address
• vehicle registration number and contract/customer number, where applicable (e.g. for long-term parking enquiries)
• communication data / free-text message field / file upload
• further details, depending on the specific request
  

Mandatory fields in the relevant form are marked as such (e.g. in bold). We use both mandatory and voluntary information exclusively to process your specific request. Under no circumstances is the data passed on to third parties, unless we need to engage third parties to process the request.

At the time the message is sent, the user’s IP address, as well as the date and time of sending, are also processed and stored. Accessing the contact form and sending the message, including any attachments, takes place via an encrypted connection (SSL/TLS). Alternatively, you may contact us using the email address given on our website.

2.   Parking space enquiries / long-term parking

On our websites, we also offer you the option of contacting us via an electronic form, for example to submit enquiries regarding long-term parking or parking space rental contracts, or requests for information. In connection with such enquiries, we collect, in particular, your form of address, surname and first name, postal address, contact details (e.g. telephone number, email address), the authorised vehicle registration number(s), the desired car park or location, the desired period, and, where applicable, details relevant to billing, in order to process your request. At the time of sending, the IP address, as well as the date and time of sending, are also processed and stored.

3.   Purpose and legal basis

The data is processed solely for the purpose of handling the relevant enquiry or usage request, and for performing or entering into contractual negotiations for the contract. The other data collected during the sending process serves to prevent misuse of the contact form and to ensure the security of our IT systems.

Insofar as the data processing is carried out for the purpose of fulfilling an order or an enquiry – for example, to enter into contractual negotiations for a long-term parking contract – the legal basis is Art. 6(1)(b) GDPR, regardless of whether contact is made via the contact form or by email. Where the user has given consent, the legal basis is Art. 6(1)(a) GDPR. The legal basis for collecting additional data during the sending process is Art. 6(1)(f) GDPR; the legitimate interest lies in preventing misuse and ensuring system security.

4.   Data deletion and storage period

As a general rule, the data is deleted once it is no longer required to achieve the purpose for which it was collected. For personal data from the contact form input fields and data sent by email, this is the case once communication with the user has ended and/or the enquiry has been finally answered. Storage with restricted processing takes the place of deletion insofar as further storage of the data is required for the reasons set out in Section IV.7. If an enquiry results in the conclusion of a parking contract, the storage of the contractual and billing data is governed by Section VI and Section IV.7.

5.   Right to object and possibility of removal

The user may, at any time, discontinue communication with us and/or withdraw their enquiry and object to the corresponding use of their data. In such a case, communication cannot be continued. All personal data stored in connection with the contact will be deleted in this case, subject to any further storage of the data for the reasons set out in Section IV.7.

Under the GDPR, data subjects are entitled, in particular, to the following rights, which may be subject to restrictions under Sections 34 and 35 of the BDSG:

1.     Right of access (Art. 15 GDPR)

Data subjects have the right to request confirmation as to whether personal data concerning them is being processed. Where our company processes personal data, data subjects are entitled to information about:

• the purposes of the processing;
• the categories of personal data (type of data) being processed;
• the recipients or categories of recipients to whom your data has been, or will be, disclosed; this applies in particular where data has been, or is to be, disclosed to recipients in third countries outside the scope of the GDPR;
• the envisaged storage period, where possible; if it is not possible to specify a storage period, the criteria used to determine that period (e.g. statutory retention periods or similar) must be communicated;
• your right to rectification and erasure of data concerning you, including the right to restriction of processing and/or the right to object (see also the following sections);
• the existence of a right to lodge a complaint with a supervisory authority;
• the source of the data, if personal data was not collected directly from the data subject.
  

You are also entitled to information as to whether your personal data is subject to an automated decision within the meaning of Art. 22 GDPR and, if so, what decision-making criteria underlie such an automated decision (logic) and what impact and significance such an automated decision may have for you.

Where personal data is transferred to a third country outside the scope of the GDPR, you are entitled to information as to whether, and if so on the basis of which safeguards, an adequate level of protection within the meaning of Art. 45 and 46 GDPR is ensured at the data recipient in the third country.

You have the right to request a copy of your personal data. The first copy is free of charge; a reasonable fee may be charged for any further copies. The provision of this copy is subject to the rights and freedoms of other persons who may be affected by the disclosure of the data copy.

2.     Right to rectification (Art. 16 GDPR)

You have the right to require us to rectify your data if it is inaccurate, incorrect and/or incomplete; the right to rectification includes the right to have incomplete data completed by means of supplementary statements or notifications. Rectification and/or completion must take place without undue delay.

3.     Right to erasure (Art. 17 GDPR)

You have the right to require us to erase your personal data, provided that

• the personal data is no longer necessary for the purposes for which it was collected and processed;
• the data processing is based on consent given by you and you have withdrawn that consent, unless another legal basis for the data processing exists;
• you have objected to the data processing under Art. 21 GDPR and there are no overriding legitimate grounds for the continued processing,
• you have objected to the data processing for direct marketing purposes under Art. 21(2) GDPR;
• your personal data has been unlawfully processed;
• the data relates to a child and was collected in connection with information society services under Art. 8(1) GDPR.
  

The right to erasure of personal data does not apply insofar as

• the right to freedom of expression and information conflicts with the request for erasure;
• the processing of personal data is necessary (i) to comply with a legal obligation (e.g. statutory retention obligations), (ii) for the performance of a task carried out in the public interest under Union law and/or the law of the member states (this also includes interests in the area of public health), or (iii) for archiving and/or research purposes;
• the personal data is necessary for the assertion, exercise or defence of legal claims.
  

Erasure must take place without undue delay. Where we have made personal data publicly available (e.g. on the internet), we must, to the extent technically possible and reasonable, ensure that other data processors are also informed of the erasure request, including the deletion of links, copies and/or replications.

4.     Right to restriction of processing (Art. 18 GDPR)

You have the right to have the processing of your personal data restricted in the following cases:

• If you have contested the accuracy of your personal data, you may require us not to use your data for other purposes, and to restrict its processing accordingly, for the duration of the verification of its accuracy.
• In the case of unlawful data processing, you may request the restriction of the use of the data under Art. 18 GDPR instead of erasure under Art. 17(1)(d) GDPR;
• If you require your personal data for the assertion, exercise or defence of legal claims, but your personal data is otherwise no longer required, you may require us to restrict the processing to the aforementioned legal purposes;
• If you have objected to data processing under Art. 21(1) GDPR and it is not yet clear whether our interests in the processing override your interests, you may require that your data not be used for other purposes, and that its processing be restricted accordingly, for the duration of the assessment.
  

Personal data whose processing has been restricted at your request may, other than being stored, only be processed (i) with your consent, (ii) for the assertion, exercise or defence of legal claims, (iii) for the protection of the rights of another natural or legal person, or (iv) for reasons of important public interest. Should a restriction on processing be lifted, you will be informed of this in advance.

5.     Right to data portability (Art. 20 GDPR)

Subject to the provisions below, you have the right to receive the data concerning you in a commonly used, electronic, machine-readable format. The right to data portability includes the right to have the data transmitted to another controller; on request, we will therefore transmit data directly to a controller named by you, or to be named by you, insofar as this is technically feasible. The right to data portability applies only to data provided by you and requires that the processing is based on consent or on the performance of a contract, and is carried out by automated means. The right to data portability under Art. 20 GDPR does not affect the right to erasure under Art. 17 GDPR. The transfer of data is subject to the rights and freedoms of other persons whose rights may be affected by the data transfer.

6.     Right to object (Art. 21 GDPR)

Where personal data is processed for the performance of a task carried out in the public interest (Art. 6(1)(e) GDPR) or to pursue legitimate interests (Art. 6(1)(f) GDPR), you may object at any time, with effect for the future, to the processing of personal data concerning you. In the event of an objection, we must cease all further processing of your data for the aforementioned purposes, unless

• there are compelling, legitimate grounds for the processing that override your interests, rights and freedoms, or
• the processing is necessary for the assertion, exercise or defence of legal claims.
  

You may object at any time, with effect for the future, to the use of your data for direct marketing purposes; this also applies to profiling insofar as it is connected with direct marketing. In the event of an objection, we must cease all further processing of your data for direct marketing purposes.

7.     Prohibition of automated decisions / profiling (Art. 22 GDPR)

Decisions that produce legal effects concerning you, or similarly significantly affect you, may not be based solely on automated processing of personal data – including profiling. This does not apply insofar as the automated decision

• is necessary for entering into, or performing, a contract with you,
• is permitted under Union or member state law, provided that such legislation contains appropriate measures to safeguard your rights, freedoms and legitimate interests, or
• is based on your explicit consent.
  

As a general rule, decisions based solely on automated processing of special categories of personal data are not permitted, unless Art. 22(4) in conjunction with Art. 9(2)(a) or (g) GDPR applies and appropriate measures have been taken to protect your rights, freedoms and legitimate interests.

Should we carry out automated decision-making within the meaning of Art. 22 GDPR, this will be expressly stated in this privacy notice.

8.     Legal remedies / right to lodge a complaint with a supervisory authority

In the event of a complaint, you may contact the competent supervisory authority of the Union or of the member states at any time. The supervisory authority named in Section II is responsible for our company.

We reserve the right to amend and/or update this Data Protection Notice from time to time. We will inform you of any material changes that affect the use of your personal data. The current version can always be found on our website under the “Data Protection” link.