An important piece of information to note initially:
1. Responsible entity
According to Article 28 of the GDPR, a licensee is to qualify as a third party data processor that processes personal data on behalf of the primary controller. The responsibility for the data processing, respectively in connection with the company web presences of the licence partners of Property Shop Investment (hereinafter the "Company web presences") which can also be accessed via our Website rests with named licensees. They are, in this context, responsible for data processing such as contact enquiries and, in particular, for data processing in connection with the search or sale/rental and valuation of properties. This adheres to Article 6(1)(b) of the GDPR. This article allows controllers to process personal data if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. In the context of third party licensees, this could mean that a controller could transfer personal data to a licensee if the licensee is providing a service or serves a function of utility to the data subject. This likewise falls under Article 6(1)(f): This article allows controllers to process personal data if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party which in the given instance would be pertaining to provision of sale/rental and valuation of properties.
The current overview of these licence partners can be found on the PSI website.
To find out which licence partner is responsible for the data processing of the company web presence that you are currently visiting, please refer to the respective data protection notices respectively the imprint at the bottom of the company web presence in question.
2. Data Protection Officer
In accordance with Article 28 of the GDPR, appointment of Data Protection Officer may be required if sensitive information is obtained, however PSI does not collect any data that may befall under the “sensitive” category.
3. Your rights as a data subject
The concept of a 'data subject' and the associated rights are primarily defined in the General Data Protection Regulation (GDPR), specifically in Article 4(1) for the definition and Articles 12-23 for the rights of data subjects. You may exercise your data protection rights against Property Shop Investment LLC insofar as the company is responsible for data processing in connection with our website. PSI adheres to such an agreement.
You have the following data subject rights as per Articles 12-23 of GDPR:
You have the right to information about the processing of your personal data (for example, the origin of this data, the purpose of processing, and the modalities of data processing) as is underscored in Article 12. Furthermore, under certain conditions, you are entitled to object to the future processing of your data, as well as the right to restrict the use or the deletion of said data as outlined in Articles 17, 16 and 21 pertaining to conditional erasure rights. Finally, you may at any time stop the sending of advertising material or the execution of market research or commercial communications as established in Article 21(2) which states: "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing." Likewise, PSI obeys Article 13 of the Privacy Directive (2002/58/EC) which expresses the use of electronic contact details for the purposes of direct marketing to solely be allowed in respect to subscribers or users who have given their prior consent.
In summary, you have a right to:
In addition, you have the right, at any time, to object to the processing of your personal data for direct marketing purposes. If you object to the processing for direct marketing purposes, we will no longer process your personal data for these purposes as per adherence to Article 21(2) and 21(3) of the GDPR which state: “Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes."
According to Art. 7 III of the EU General Data Protection Regulation (hereinafter “GDPR”), you may at any time revoke your initial consent towards us. Once the consent is revoked we will no longer continue to process the data. The definition of “consent” in the General Data Protection Regulation (GDPR) is found in Article 4(11). It reads: “Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” This in turn signifies that for consent to be construed valid under GDPR, it must be freely given, clear, specific, and informed.
Please note that your right to the deletion of your data is subject to certain restrictions. For example, we do not have to or are not allowed to delete data that we are required to retain due to legal retention periods. Data that we need to assert, exercise or defend due to legal claims are also excluded from your right of deletion. The aforementioned restrictions to this right are enshrined in Article 17(3) of the GDPR. The regulation states that the right to deletion does not apply if processing is necessary for one of the following reasons:
If you have a complaint about the way we process your data, you have the recourse to a supervisory authority, in particular in the member state of your residence, workplace or the place of the alleged breach as protected by Article 77 of the GDPR which states "Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation."
We reserve the right to disclose information about you if we are required to do so by law enforcement bodies or other lawful authorities. Legal basis: Art. 6 I sentence 1 lit. c GDPR (legal obligation) which likewise encompasses the following statement "processing is necessary for compliance with a legal obligation to which the controller is subject." This denotes legal freedom of disclosure under scenarios of external legal obligation pertaining to law enforcement.
Article 15 of the General Data Protection Regulation (GDPR) stipulates the right of access and specifies that data subjects have the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what purpose. Furthermore, the controller shall provide a copy of the personal data, free of charge, in an electronic format. This implies that the data controller needs to disclose which data of the individual data subject is being processed.
1. What data do we process from you (hereinafter referred to as "you" or "user")?
When you use our Website, we process personal data, in particular:
2. Purpose of the processing
(GDPR) makes it compulsory for organizations to state the purpose of data collection in Article 13(1)(a) and Article 14(1)(a). These articles state that organizations must provide data subjects with clear and concise information about the purposes for which their personal data is being collected and processed. This information must be provided at the time when the personal data is collected, or at the latest within a reasonable period of time after the data is collected. In addition, the principle of 'purpose limitation' in Article 5(1)(b) also underlines the need for clear purposes, stating that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.” PSI thus adheres to the aforementioned statutory provisions by vividly stating the purpose of data collection.
We process the personal data of the users of our Website (https://psinv.net) for the following purposes:
In summary: The legal basis for the processing of your personal data is Art. 6 I sentence 1 lit. a GDPR if the processing is based on consent, Art. 6 I sentence 1 lit. b GDPR if the processing is based on a (possibly pre-contractual) contractual relationship Art. 6 I sentence 1 lit. f GDPR if the processing is based on the legitimate interest of PSI. If the processing of personal data is necessary to comply with a legal obligation to which Property Shop Investment is subject, Article 6 I sentence 1 lit. c GDPR is the relevant legal basis.
If the legal basis is your consent, you are entitled to revoke your consent at any time without affecting the lawfulness of the processing of your personal data carried out based on the consent until revocation. If the legal basis is the legitimate interest, you are also generally entitled to object to the processing of personal data relating to you at any time for reasons arising from your particular situation. In this respect, Art. 21 GDPR applies.
3. Disclosure of your personal data
Article 13(1)(e) and Article 14(1)(e) of the GDPR require the data controller to provide information about the recipients or categories of recipients of the personal data, if any. In cases where it's not practical to list each recipient individually, the GDPR allows for categories of recipients to be indicated. Likewise, Article 30(1)(d), which requires controllers to keep a record of the categories of recipients to whom personal data have been or will be disclosed. This record must be kept for at least 5 years after the end of the processing activities. Due to the scale and complexity of data processing by the PSI group of companies, it is not possible to list each recipient of your personal data individually in this data protection policy, which is why, as a rule, only categories of recipients are indicated.
Within the PSI group of companies, your data will be disclosed to those PSI related Companies or entities that require the data to fulfil our contractual and legal obligations and to pursue legitimate interests in the context of this Website service or based on your consent. This includes PSI Companies that support the provision of our website, direct marketing or other IT infrastructure, that provide webinar events, that carry out the valuation of properties or that send out newsletters. Article 6(1)(f) allows processing if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. Article 13(1)(e) and Article 14(1)(e) specify that the data controller should inform the data subject about the recipients or categories of recipients of the personal data. PSI thus adheres to this.
If your contact request relates to offers from other companies of the PSI group of companies, PSI will transmit the personal data you have entered to the respective company based on a so-called legitimate interest within the PSI group of companies as per Article 6(1)(f) pertaining to the concept of legitimate interest validation for the data controller and third parties.
If, on the other hand, your contact request concerns offers from other companies of the Property Shop Investment Group (i.e. our licence partners), we will pass on your personal data from the PSI group of companies with your prior consent as is covered under Article 6(1)(a) which states that processing is lawful if "the data subject has given consent to the processing of his or her personal data for one or more specific purposes." Furthermore, Article 7 of the GDPR provides conditions for consent. It states that the request for consent must be presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language.
4. Transfer of data to non-EEA countries
In addition to the above paragraph "Disclosure of your personal data", the following applies:
Recipients of personal data may be located outside the EEA/UK. Where personal data is transferred to locations outside the EEA/UK, we will ensure, as required by law, that your data protection rights are adequately protected, either because the European Commission has decided that the country to which personal data is transferred ensures an adequate level of protection (Art. 45 GDPR) or the transfer is subject to adequate safeguards (e.g. standard contractual clauses) as agreed by the European Union and the recipient of the data (Art. 46 GDPR) unless the GDPR provides for an exception (Art. 49 GDPR). Furthermore, where necessary, we intend to agree to additional measures with recipients to ensure an adequate level of data protection.
Under Article 30, organizations are required to maintain a record of processing activities, which could include these safeguards. Also, Article 12 mandates that the controller takes appropriate measures to provide any information referred to in Articles 13 and 14 and the communications under Articles 15 to 22 and 34 relating to processing, in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Copies of the adequate safeguards (where we rely on them) and a list of recipients outside the EEA/UK are available on request. Please note that these copies may be redacted to the necessary extent to protect trade secrets or other confidential information as per the broader scope of the Trade Secrets Directive (EU) 2016/943.
5. Storage and deletion of your data
Property Shop Investment will retain your personal data for the time necessary to achieve the purposes for which data is collected, including any retention period required by the applicable law (e.g. retention of accounting records). The handling of data retention periods in GDPR is covered by Article 5(1)(e) which states that personal data shall be: 'kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation').'
6. Tracking Pixels and Analytics Tools
Information Collection via Tracking Technologies
We prioritize your privacy and believe in transparency. As part of our commitment to upholding these principles, we're providing details on the tracking technologies implemented on our platform and how they interact with your personal data.
Google Analytics: We utilize Google Analytics to better understand user interaction with our website. While it sets cookies on your browser or mobile device, it does not directly collect personally identifiable information without your explicit consent. Instead, it helps us analyze the behavior of visitors to our website.
Facebook Pixel: To measure the effectiveness of our Facebook advertisements, we employ the Facebook Pixel. This tool collects data related to actions undertaken on our website resulting from our Facebook advertising.
Snapchat Pixel: Through the Snapchat Pixel, we measure the performance of our advertisements on Snapchat. It provides insights into user interactions originating from our Snapchat ads.
Google Ads Pixel: The Google Ads Pixel aids us in evaluating and optimizing our advertising campaigns on the Google Ads platform. It gathers data pertaining to your interactions with both our ads and website.
TikTok Pixel: To gauge the efficiency of our TikTok ads, we've implemented the TikTok Pixel. This tool gathers data on user engagements stemming from our TikTok advertisements.
VK Pixel: With the VK Pixel, we monitor the success rate of our VK ads. This technology captures data on how VK platform users interact with our site post-engagement with our advertisements.
Microsoft Clarity: This tool offers insights into user behavior, assisting in enhancing our website's user experience. It collects data on interactions such as clicks, mouse movements, and scrolling actions.