Data Privacy for shareholders
Data Privacy Notice and Information on the right to object pursuant to Sec. 67 German Stock Corporation Act for shareholders of Vonovia SE and for authorised representatives of shareholders
1. General Information
Vonovia SE takes your privacy and the protection of your personal data very seriously. In this data privacy notice, we want to inform you about which personal data we process from you as our shareholder or your authorised representative in general and in connection with the preparation, conduction and follow-up of our General Meetings and which rights you have under Regulation EU 2016/679 (General Data Protection Regulation – GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) with regard to the processing of your data.
We will conduct the General Meeting in 2020 as an assembly without presence using means of remote communication (virtual General Meeting) with the possibility of following the virtual General Meeting and exercising voting rights by means of electronic connection (Connection). Shareholders and their authorised representatives can therefore not physically participate in the General Meeting. However, they can follow the entire General Meeting by video and audio transmission via the password-protected online service Vonovia InvestorPortal, which is also used for electronic connection. It can be accessed via https://investors.vonovia.de/agm.
b) Data controller
44803 Bochum, Germany
Fax: +49 (0) 234 314 2944
(c) Contact details of the Data Protection Officer
2. Categories of data
(a) If (i) you purchase Vonovia SE shares, e.g. as part of a share purchase or through a capital increase, (ii) you participate in a General Meeting as a shareholder or authorised representative or (iii) we contact you, we – as the controller within the meaning of data protection laws – process the following of your personal data:
- name and surname, title,
- date of birth (only of shareholders),
- nationality (only of shareholders),
- E-mail address,
- class of shares,
- type of ownership of the share,
- number of shares, and
- ticket number or confirmation of registration.
(b) If you use our Vonovia InvestorPortal, via which, amongst others, the virtual General Meeting will be conducted, we also process access data required for operating the Vonovia InvestorPortal. You can find information on data protection regarding the processing of personal data from shareholders or their authorised representatives for using the Vonovia InvestorPortal generally and in connection with the preparation, execution and follow-up of General Meetings in a separate data privacy notice, which can be accessed via https://investor.computershare.de/vonovia?plang=en.
c) If you contact us, we additionally process the personal data required to answer the respective request, such as your e-mail address or telephone number.
d) In addition, we also process information on motions, questions, election proposals, requests, objections and other verbal contributions from shareholders or their authorised representatives at the General Meeting as well as on their voting behaviour.
e) If we broadcast a non-virtual General Meeting live on the Internet by means of video and audio transmission and you make a verbal contribution at the non-virtual General Meeting or otherwise enter the recording area, this live broadcast will also include your appearance and verbal contribution.
3. Purpose and legal basis of the processing operation
The processing of the above-mentioned data serves the purposes described below.
a) Maintaining the share register and fulfilling legal and supervisory obligations
We process the data described under section 2 a) in order to comply with our legal obligation to maintain the share register. In addition, we may process personal data to fulfil other legal obligations, such as regulatory requirements and obligations under stock corporation law, securities law, tax law and commercial law.
The processing is necessary to fulfil our obligations under stock corporation law pursuant to Section 67 of the German Stock Corporation Act (AktG). The legal basis for the processing of data is Article 6(1)(c) GDPR.
b) Preparation, execution and follow-up of General Meetings
We process the data described under section 2 a) and b) in order to process the participation of shareholders and their authorised representatives in the General Meetings (e.g. by checking their eligibility to participate, creation of the list of attendees) and to exercise their rights at the General Meeting (including granting and revoking powers of attorney and instructions via the InvestorPortal on the company’s website at https://investors.vonovia.de/agm) as well as to ensure the observance of voting bans, the lawful adoption of resolutions and evaluation of cast votes at the General Meeting.
The processing of your personal data is necessary for the proper conduct of the General Meeting. If you do not provide us with the necessary personal data, we might not be able to allow your attendance in the General Meeting.
The legal basis for the processing is Art. 6(1)(c) GDPR in conjunction with our obligations under stock corporation law pursuant to Art. 53 of the SE Council Regulation in conjunction with Section 118 et seqq. AktG and, if applicable, in conjunction with Art. 1(2) nos. 2 – 4 of the Act on Measures in Corporate, Cooperative, Association, Foundation and Home Ownership Law to Combat the Effects of the COVID 19 Pandemic (Gesetz über Maßnahmen im Gesellschafts-, Genossenschafts-, Vereins-, Stiftungs- und Wohnungseigentumsrecht zur Bekämpfung der Auswirkungen der COVID-19-Pandemie; C19-AuswBekG).
Insofar as we take down in shorthand your verbal contributions described under section 2 e) during the non-virtual General Meeting without being legally obliged to do so, this is done to ensure the proper conduct of the General Meeting and to be able to deal with your questions and motions. The stenographic minutes will not be published. The legal basis for this processing is Art. 6 (1)(f) GDPR and our legitimate interest is to ensure that the General Meeting is executed properly and that our shareholders’ participation rights can be realized in the best possible way.
c) Broadcast of the General Meeting by means of video and audio transmission on the Internet
The entire General Meeting may be broadcast live and publicly accessible on the Internet by means of video and audio transmission. Possibly, a recording of the virtual or non-virtual General Meeting will be made until the end of the speech of the Management Board, which will be made publicly available on the Internet on demand after the end of the General Meeting. Beyond this, neither image nor sound recordings will be made. To the extent you enter the recording area or make a verbal contribution during recording activities at a non-virtual General Meeting, the live broadcast or the respective recording will include your appearance and verbal contribution. The legal basis for this processing is Art. 6 (1)(f) GDPR. Our legitimate interest is to enable interested shareholders and the public to follow the General Meeting via the Internet in accordance with the express permission in the German Stock Corporation Act and our by-laws.
d) Investor Relations
We process the data of shareholders described under section 2 a) in order to contact you so that we can send you information about our company that we consider to be of particular interest to investors.
The legal basis for the processing of your personal data is Art. 6(1)(f) GDPR. We have a legitimate interest in representing our company appropriately to our shareholders and in disclosing information about business incidents in order to enhance our corporate reputation.
e) Operation of the InvestorPortal
We process the data of shareholders described under section 2 a), b) and d) in order to be able to provide you the Vonovia InvestorPortal throughout the year. There you will have the opportunity to view your shareholder data as well as data on your share portfolio, to notify us of any changes of your e-mail address and to register to upcoming annual General Meetings or to appoint authorised representatives.
The legal basis for the processing of your personal data is Art. 6(1)(f) GDPR. Our legitimate interest lies in our ambition to provide you with a free service to inspect and manage your shareholder and portfolio data and to conveniently register for our General Meetings.
f) Subscription offers for capital increases
We process the data of shareholders described under section 2 a) in order to be able to make you subscription offers. A subscription offer gives you the opportunity to acquire new shares. As a rule, this will be delivered to you by your depositary bank and published in the Federal Gazette (Bundesanzeiger) at the same time. However, we must exempt citizens of certain countries from these subscription offers due to local legal requirements under the securities laws of those countries. That is why we must also process the information about your nationality.
The legal basis for the processing of your personal data is Art. 6(1)(f) GDPR. Our legitimate interest lies in the fact that we must comply with the legal regulations of the respective countries.
g) Statistical purposes
We process the data described under section 2 a) and d) in order to compile statistics on our shareholders and on shareholder development.
The legal basis for the processing of your personal data is Art. 6(1)(f) GDPR. We have a legitimate interest in compiling statistics so that we can identify the composition of our company’s shareholder structure. In addition, we minimise risks for those affected by this by anonymising personal data in the course of statistical processing so that conclusions about individual persons are made impossible.
h) Processing of your requests
We process the data described under section 2 c) in order to be able to process your request and answer your inquiries. The legal basis for this processing of your personal data is Art. 6(1)(b) GDPR
i) Other purposes
If required by law, we will inform you in advance if we process your personal data for purposes other than those specified here.
4. Recipients and categories of recipients of personal data
We use various service providers for the processing of personal data.
As we issue registered shares, we are legally obliged to maintain a share register. We have commissioned Computershare Deutschland GmbH & Co KG, Elsenheimerstr. 61, 80687 Munich, Germany therewith.
The Vonovia InvestorPortal is operated by Computershare exclusively on behalf and in accordance with the instructions of Vonovia SE.
As part of the preparation, conduct and follow-up of General Meetings, we also commission other service providers who receive personal data from data subjects (e.g. for the provision of the Vonovia InvestorPortal, printing companies for sending General Meeting documents, security services for admission controls).
Computershare and the other service providers only receive such personal data from us that is necessary for the performance of the commissioned service. Computershare and the other service providers process the data exclusively on behalf and in accordance with the instructions of Vonovia SE. All our employees and all employees of external service providers who have access to and/or process personal data are obliged to treat this data confidentially.
If you attend the General Meeting, we are obliged, pursuant to Section 129(1) sentence 2 AktG, to file you in the list of participants, stating your name, place of residence, number of shares and type of ownership. These data are visible to all other participants of the General Meeting during the meeting and to shareholders up to two years thereafter (Section 129(4) AktG).
Your data is generally being processed in countries belonging to the European Union. If persons from countries outside the European Union and the European Economic Area hold shares in our company, we will also send certain information to these shareholders (e.g. invitations to General Meetings). If personal data are also included in these notifications (e.g. motions to General Meetings with the name of the applicant being stated), this data will also be transferred to third countries. The provisions of the GDPR are not directly applicable in third countries. In the absence of an adequacy decision of the European Commission, these countries may provide a lower level of protection for your personal data. A transfer is nevertheless necessary in order to inform all shareholders equally, since we are not permitted to exempt shareholders from third countries from our duty to provide information. With the transmission we fulfil our contractual obligations. The legal basis for the transmission is Art. 49(1)(b) GDPR.
5. Data sources
If you purchase shares, your personal data will not be collected by us, but by the depository banks involved in the share transaction. This is carried out via Clearstream Banking AG, Mergenthalerallee 61, 65760 Eschborn, which, as the central securities depository, is responsible for the technical settlement of securities transactions and the deposit of shares for credit institutions.
If you contact us, we will receive the personal data directly from you.
If you act as authorised representative of a shareholder, we receive your personal data from the shareholder who granted you the power of attorney and directly from you as far as your behaviour during the General Meeting is concerned.
6. Storage period
In principle, we anonymise or delete personal data if it is no longer required for the above-mentioned purposes and if the anonymising or deleting does not conflict with legal requirements for proof and storage (e.g. under the German Stock Corporation Act, the German Commercial Code, the German Tax Code or other legal provisions).
To the extent required by law or if the company has a legitimate interest in the storage of personal data, for example in the event of court or out-of-court disputes at the General Meeting or in order to be able to track the application and voting behaviour, a longer storage of personal data is possible. In these cases, however, we do not necessarily store personal data of all the categories listed under section 2, but only those data which are absolutely necessary for achieving the respective purposes – for example to prove voting behaviour.
After the personal data are no longer needed for these purposes, they are anonymised or deleted.
7. Rights of data subjects
As a data subject, you can contact our data protection officer named in section 1. c) in order to exercise your legal rights in accordance with the GDPR. If the legal requirements are met, you may be entitled to the following rights:
- the right to obtain information on data processing and a copy of the data processed (right of access by the data subject, Art. 15 GDPR)
- the right to obtain the rectification of inaccurate data or have incomplete data completed (right to rectification, Art. 16 GDPR),
- the right to obtain the erasure of personal data without undue delay (right to erasure, Art. 17 GDPR),
- the right to obtain restriction of processing personal data (right to restriction of processing, Art. 18 GDPR)
- the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided (right to data portability, Art. 20 GDPR)
|Where we process your personal data for the purposes of the legitimate interests pursued by our company or a third party, you also have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you (right to object, Art. 21 GDPR). The processing of personal data will then be cancelled, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.|
Regardless of this, every shareholder and authorised representative has the right to lodge a complaint with a competent supervisory authority pursuant to Art. 77 GDPR.
8. Right of objection according to Section 67 AktG
According to Section 67 para. 6 AktG you also have the right to object to the use of your data for advertising purposes.
The Management Board