Which data and sources do we use?
MEAG leases out both commercial and residential properties. To this end, we gather personal data from prospective tenants in the pre-contract stage of negotiations, using the internet platform EverReal. For more information on how EverReal processes your data, please see the company’s privacy statement at evereal.co.
The data processed by MEAG include in particular the master data (first name, last name, titles), contact data (e.g. private address, private and/or business (mobile) telephone number, e-mail address), (electronic) correspondence and other details (e.g. number of children (self-disclosure), bank connection). In the self-disclosure, special categories of personal data may also fall within this scope (sensitive data pursuant to Art. 9 GDPR), if this is required to broker the property (e.g. required structural prerequisites/modifications). Your date of birth and nationality are also required for the financial sanction examination required by law.
As a rule, your personal data will be gathered and processed in the lead-up to the lease contract being finalised. In certain constellations, your personal data may also be collected from other places if required by law. These include in particular the gathering of information relevant to a tenancy from the presiding labour office, social security authority (housing support), or in some rare cases from your employer, upon agreement. We can also receive data from third parties (e.g. brokerage sites, real estate agents, credit check companies).
For what purpose and on what basis do we process your data?
We process personal data in particular to establish, execute and terminate leases, i.e. to fulfil contracts or during pre-contractual measures. The main legal basis for this is Art. 6 para. 1 lit. b GDPR.
In addition, approvals can be called upon as data protection authorisations pursuant to Art. 6 para. 1 lit. a GDPR. If the processing of the data is based on a consent given, you can revoke the consent at any time with effect for the future.
We also process your data in order to meet in particular our German legal obligations as a lessor, on the basis of Art. 6 para. 1 lit. c GDPR. In some cases, e.g. when establishing creditworthiness, investigating criminal acts or when data are exchanged internally for administrative purposes, your data may be processed by us or third parties (e.g. public authorities) to safeguard justified interests pursuant to Art. 6 para. 1 lit. f GDPR.
In certain cases we are obliged to perform a legitimation check when entering into a lease, to prevent money laundering.
We are also obliged to compare your data with the "terror lists" / "sanction lists" due to the European anti-terror directives 2580/2001 and 881/2002, in order to ensure that no money or other resources are made available for terrorist purposes.
We only process some categories of personal data if you give us your explicit consent or if the processing serves to exercise social security or social protection rights or obligations.
Who receives your data?
Within our company, only the people who need your data to meet the above purposes are given access to the data. We sometimes use external service providers for these purposes. You will find the categories of service provider/recipient that process your data or to which we send your data, here.
When selling real estate, personal data (in particular written correspondence) is forwarded to the potential buyers. The legal basis for this is MEAG's justified interest pursuant to Art. 6 para. 1 lit. f GDPR.
How long do we store your data?
The collected data are deleted immediately after signing the lease agreement, or when it becomes clear that no lease will result with you. If the lease does come about, we delete your personal data in accordance with the retention periods prescribed by law, which begin at the end of the lease. However, there are data that are subject to a statutory retention obligation and that normally have to be kept for ten (10) years, and in exceptional cases (e.g. in order to be able to provide evidence of how the property was used) for up to thirty (30) years.
Is there an obligation to provide the data?
Within a lease relationship or the initiation of a lease, the personal data are to be provided that are required to found, execute and terminate the lease agreement. Without these data we are not able to decide whether to enter into or execute a lease.
Does MEAG have automatic decision-making?
We do not have automatic decision-making/profiling at this time.