Privacy Policy

This Privacy Policy provides you with information on the processing of your personal data (hereinafter “you,” “your,” “interested parties,” “tenants,” “subtenants” or “buyers”) when you visit and use this website, when you initiate and conclude an agreement with us or purchase our services, and in connection with marketing activities of Vonovia SE (hereinafter “Vonovia,” “we” or “us”) and its affiliated companies (“Vonovia Immobiliengruppe,” “we” or “us”) in accordance with the EU General Data Protection Regulation (hereinafter “GDPR”).

1. Scope of Application, Controllers and Definitions

1.1. Scope of Application

1. This Privacy Policy applies to the processing of your personal data if you are a visitor to our website, an interested party, a tenant, subtenant or buyer, either now or in the future, as well as in the context of our marketing measures. If you are acting as a legal entity within this context, this Privacy Policy only applies to a limited extent (the GDPR only covers data concerning natural persons.). Depending on the circumstances, you should then inform your employees accordingly.

2. You can access, save and print out this Privacy Policy from any Vonovia SE and Vonovia Kundenservice GmbH website free of charge at any time. Other websites (e.g., Vonovia Immobilien Treuhand GmbH websites) are not covered by this Privacy Policy and make their own specific data privacy information available.

1.2. Controllers

The following are jointly responsible for the processing of your data:

1. In cases involving prospective tenants, Vonovia Kundenservice GmbH and Vonovia SE are the “joint controllers.”

2. In cases involving tenants, subtenants and potential buyers, Vonovia Kundenservice GmbH, Vonovia SE and the real estate/letting/selling company concerned are the “joint controllers” (if you are one of our tenants, please refer to your lease agreement).

3. Vonovia SE (Universitätsstrasse 133, 44803 Bochum, Germany) and Vonovia Kundenservice GmbH (Am Silberpalais 1, 47057 Duisburg, Germany) are the central contact points for any inquiries. Please direct your inquiries:
  • By telephone to: +49 (0) 234 414 700-000
  • By fax to: +49 (0) 234 314 888-4414
  • By sending an email to: service@vonovia.de

1.3. Group Data Protection Officer

If you have any questions regarding data protection, please contact

Ernst & Young Law GmbH
c/o Vonovia SE
Postfach
44784 Bochum, Germany
Email: datenschutz@vonovia.de

1.4. Definitions

This Privacy Policy is based on the following terms, which we have defined in order to make them easier to understand:

1. The GDPR is the European General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and the repeal of Directive 95/46/EC).

2. “Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing. In connection with the collection of rent, recipients may include, for example, banks or the post office via which we send you your lease documents.

3. The “joint controllers” are two or more controllers within the meaning of Section 1.4.9. that jointly determine the purposes of processing, and the means used to process, personal data. For example, Vonovia Kundenservice GmbH and Vonovia SE jointly determine the means used to process, and the purposes of processing, personal data concerning prospective tenants, meaning that they are joint controllers (Section 1.2.1.).

4. You are considered to be an “interested party” if, for example, you use our websites to obtain information about Vonovia and the products and services we offer, you create an account in the online customer portal (available at mein.vonovia.de) and use its functions (such as saving your favorite properties) or arrange viewing appointments with us.

5. You are considered to be the “buyer” from the time at which you sign the purchase agreement for a Vonovia Immobiliengruppe property with the notary.

6. You are considered to be the “tenant” from the time at which you receive a signed copy of your lease agreement back from Vonovia Immobiliengruppe.

7. “Personal data” refers to all information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 4 (1) GDPR). Personal data can include, by way of example, your name and contact details, user behavior or bank account details.

8. You are considered to be a (future) subtenant if an existing tenant submits a subletting application to us in which you are named as the subtenant.

9. The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. Vonovia SE, and others as are herein described, is the controller for the purposes of the data processing described in this Privacy Statement (Section 1.2.).

10. “Processing” includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data (Article 4 (2) GDPR). Processing may include the collection and use of your contact details to arrange a viewing appointment.

11. Vonovia Immobiliengruppe comprises all companies affiliated with Vonovia SE pursuant to Section 15 of the German Stock Corporation Act (AktG).

2. Purposes, Legal Bases and Data Categories Relating to the Processing of Your Personal Data

2.1. Processing of Your Data When You Visit our Websites

If you access our websites to obtain information about the properties and services we offer without registering in the customer portal, without arranging a viewing appointment with us or without actively providing us with information in any other way (use for informational purposes only), we will process your personal data. Your personal data will be processed for the following purposes and on the basis of the following legal principles:

2.1.1. Processing for the Purposes of Making the Websites Available and to Ensure IT Security

1. When you visit our websites, we process the personal data concerning you that we require, from a technical perspective, to be able to make our websites available to you and to ensure stability and security when you visit our websites. We process the following personal data for this purpose:
  • IP address
  • Browser user agents
  • Cookies (Section 2.1.3)

2. We process your personal data based on our legitimate interest in providing you with information about our products and services on our websites, and in ensuring IT security for you when you visit our websites, on the basis of Article 6 (1) sentence 1f GDPR.

2.1.2. Processing for Analytical Purposes

1. When you visit our websites, we may monitor and document how you use our websites, e.g., your surfing behavior on our websites and which properties you are interested in. We process the following personal data for this purpose:
  • IP address
  • UU ID
  • WEB ID
  • Cookies (Section 2.1.3)

2. In this respect, we process your personal data based on our legitimate interest in conducting analyses and improving our website and our products and services on the basis of these analyses, and based on our legitimate interest in fraud prevention, on the basis of Article 6 (1) sentence 1f GDPR.

3a. In order to perform these analyses, we use Google Analytics, a web analysis service from Google Inc. (“Google”), on our websites. Google Analytics uses cookies, which enable an analysis of how you use the website. The information generated by the cookie about the use of our websites is usually transmitted to a Google server located in the U.S., where it is stored. However, if IP anonymity is activated on our websites, Google will shorten the IP address of website visitors in member states of the European Union or other contracting states of the agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server located in the U.S. and truncated there. Google will use this information on behalf of Vonovia to analyze your usage of the websites, to compile reports about website activity and to provide other services related to website usage and Internet usage for Vonovia.
The IP address sent by the user’s browser for the purpose of Google Analytics will not be combined with other data from Google.
You can prevent storage of the cookies by configuring your browser software accordingly; however, we must advise you that if you do so, you may not be able to comprehensively use all functions of these websites.
You may also prevent the collection of the data generated by the cookie and relating to your use of the websites (including your IP address) by Google, and also prevent the processing of this data by Google, by downloading and installing the browser plug-in available under the following link: An opt-out cookie will be stored which prevents the collection of your data for future visits to these websites.
Our websites use Google Analytics with the extension “_anonymizelp().” This means that IP addresses are only processed in truncated form to eliminate the possibility of direct personal identification.
Google Analytics is used in accordance with the conditions agreed between the German data protection authorities and Google.
You can find further information on the terms of use and data protection at: In connection with the use of Google Analytics, your personal data will be transmitted to the U.S. The European Commission has not decided that the U.S. offers an adequate level of data protection within the meaning of the GDPR; no such adequacy decision (Article 45 GDPR) has been made. However, Google LLC is subject to the EU-U.S. Privacy Shield. This ensures an adequate level of protection for your personal data. You can access the full text of the EU-U.S. Privacy Shield Framework at the following link:

3b. Data is collected and stored on this website for marketing and optimization purposes using technologies of etracker GmbH
www.etracker.com.User profiles may be created using this data under a pseudonym. This may involve the use of cookies. Cookies are small text files that are stored locally in the cache of the web browser of the page visitor. Cookies enable the web browser to be recognized at a later date. Without the specifically issued consent of the data subject, the data collected using etracker technologies will not be used to personally identify visitors of this website and will not be associated with personal data of the pseudonymized individual. It is possible to withdraw consent for the collection and storage of data at any time with future effect.

2.1.3. Use of Cookies

1. When you use our website, cookies are stored on your computer. Cookies are small text files that are assigned to the browser you use and are stored on your hard drive and that send certain pieces of information to the site that created the cookie. This information also contains personal data. Cookies cannot run programs or transmit viruses to your computer. They serve to make the website more user-friendly and effective overall.

2. The cookie information of Vonovia SE and the companies affiliated with Vonovia SE pursuant to Section 15 AktG (available at www.vonovia.de/cookie-richtlinien) applies to the use of our websites.

2.2. Registration for the Online Customer Portal

1. You can register to use the online customer portal on our website. Our online customer portal provides you with various services relating to your property search and in the context of your tenancy. You need to provide personal data in order to register for and use our online customer portal. Mandatory fields are marked accordingly on the input form. We use what is known as the “double opt-in procedure” for registration purposes. As soon as you have completed the input form, you will receive an email from us regarding your registration that contains a link. Your registration is not complete until you click on this link to confirm your registration.

2. We process your personal data to enable you to create and use your account on the online customer portal and based on our legitimate interest in providing you with information about the properties and services we offer, as well as with special functions in this regard (such as accessing favorites the next time you log in). The data is processed on the basis of Article 6 (1) sentences 1b and 1f GDPR. If you provide voluntary information during the registration process, you consent to the processing of this data by us. Your voluntary data will be processed with your consent within the meaning of Article 6 (1) sentence 1a GDPR.

2.3. Editing Your Profile in the Online Customer Portal

1. After you register, you can view, amend and supplement your data in the online customer portal under “My profile.” Mandatory data is marked accordingly. You can also provide further voluntary information.

2. The processing of the mandatory data serves to allow us to make our online customer portal available and, when applicable, also to initiate, prepare, execute and process your contract and/or other services offered by Vonovia or Vonovia Immobiliengruppe. Your personal data is processed and saved on the basis of Article 6 (1) sentence 1b GDPR. If you provide voluntary information, you consent to the processing of this data by us. Your voluntary data will be processed with your consent within the meaning of Article 6 (1) sentence 1a GDPR.

2.4. Marketing Measures for the Allocation of Our Properties (Informational Emails)

We perform marketing measures relating to the allocation of our properties. If you are interested in our properties, for example, you can sign up for our informational emails. These emails provide you with information on properties and services offered by Vonovia Immobiliengruppe. We process your personal data for this purpose if you grant us your consent within the meaning of Article 6 (1) sentence 1a GDPR.

2.5. Arrangement of Viewing Appointments

1. If you are interested in our properties, you can arrange viewing appointments with us. You can contact us and request a viewing appointment by phone, using WhatsApp, Telegram Messenger, via our chatbot on our website, in writing, via the online customer portal or via our website using the property search function. We process your personal data in order to arrange a viewing appointment with you and to prepare for and execute this appointment on the basis of Article 6 (1) sentence 1b GDPR.

2. If you use WhatsApp or Telegram, the privacy policies of the messenger service/social network you are using apply. For further details, please refer to the corresponding privacy policies:

2.6. Interested Parties Suggested by Existing Tenants

If an existing tenant terminates their lease with us, they may be able to recommend you as a potential future tenant for the property. If a lease agreement is concluded between you and us, the existing tenant that recommended you will receive a bonus from us, subject to certain conditions. You can complete a form together with the existing tenant for this purpose (“Tenants recommend tenants”). We process your personal data as an interested party in order to initiate a lease agreement with you on the basis of Article 6 (1) sentence 1b GDPR. Within this context, we process personal data concerning existing tenants who are recommending new tenants based on our legitimate interest in performing marketing measures and finding suitable new tenants for our properties, on the basis of Article 6 (1) sentence 1f GDPR.

2.7. Prospective Tenants Recommended by Parties With Property Allocation Rights

“Parties with property allocation rights” (the person who has provided a significant proportion of financing for a building) can recommend/name potential tenants (assigned tenants) for properties subject to allocation rights. The next step involves organizing viewing appointments with these and all other prospective tenants. Within this context, we process your personal data in order to initiate and, when appropriate, conclude your lease agreement with us on the basis of Article 6 (1) sentence 1b GDPR.

2.8. Reservation of a Property and Conclusion of the Lease Agreement

1. If you like one of our properties during a viewing appointment, you can reserve it. We then prepare a reservation record and ask you to submit all of the documents required for the conclusion of the lease agreement with us. Within this context, we process your personal data in order to reserve the property for you and to prepare the lease agreement with you and store it in our systems, on the basis of Article 6 (1) sentence 1b GDPR.

2. Once you have signed your reservation record, we will carry out a credit check. The credit check is carried out via a credit rating service provider (such as infoscore Consumer Data GmbH or Creditreform e.V.). Your credit rating is assessed on the basis of mathematical statistical procedures, known as scoring. This involves transmitting the personal data concerning you that is necessary for the credit check to the credit rating service provider. We process your personal data for the purposes of the credit check in order to avoid payment defaults. Using the personal data transmitted, including the address details, a statistical probability of a credit default and, as a result, your solvency is calculated. The credit rating service provider then transmits your score value to us. We may also use the services offered by address verification companies as part of the credit rating process to check the address you provided. This personal data is processed for the execution of your contract with us on the basis of Article 6 (1) sentence 1b GDPR and based on our legitimate interest in avoiding a payment default on your part, on the basis of Article 6 (1) sentence 1f GDPR. If the credit check is positive, we can offer you the property you have reserved; if it is negative, we will perform a manual check to determine whether the reserved property can be offered to you. If we are unable to offer you the property, you can, however, still apply for other Vonovia properties. The scoring only provides information on whether you can meet the payment obligations for the specific reserved property. We only use the scoring information to protect ourselves against possible payment defaults.

2.9. Execution of the Lease Agreement: Processing of Personal Data Concerning Existing Tenants

When we countersign your lease agreement, you are considered an existing tenant. Your lease agreement and any appendices are stored in our systems. If you have registered for our customer portal (see Section 2.2), you can view and download these documents there. As part of the execution of your lease agreement (e.g., when you pay your rent and ancillary expenses under the lease agreement), we process your personal data for the execution and performance of your lease agreement on the basis of Article 6 (1) sentence 1b GDPR.

2.10. SEPA Direct Debit Mandate

For the purposes of settling your rent and your ancillary expenses under the lease agreement (such as heating costs), you can issue us with a SEPA (Single Euro Payment Area) direct debit mandate and authorize us to collect these payments. You can also grant us this authorization via the online customer portal under “My lease agreements/payment options” by configuring the appropriate settings. In addition, we prepare a consumption analysis in connection with the heating cost bill. Within this context, we process your personal data in order to execute the lease agreement with you and to process the payment obligations that arise within this context with you, on the basis of Article 6 (1) sentence 1b GDPR.

2.11. Rental Management

We are obliged by law to review the rent. We process personal data concerning our tenants within this context. Your personal data is processed to enable us to verify whether the rent charged complies with the legal requirements and whether the property in question is occupied in accordance with the legal requirements, on the basis of Article 6 (1) sentence 1c GDPR.

2.12. Housing Provider Certificate and Housing Eligibility Certificate

1. If you conclude a lease agreement with us and then move into your apartment, we are legally obliged (Section 19 of the German Federal Act on Registration) to provide the residence registration authorities with confirmation that you have moved into the property. For this purpose, we will issue you with a housing provider certificate to submit to the residence registration authorities. We process your personal data for this purpose.

2. Some of our apartments are financed using public funds. If you wish to rent one of these apartments, you must prove your eligibility by presenting a housing eligibility certificate. If you apply for and receive a housing eligibility certificate from the responsible housing authorities, it will be forwarded to us. We will then complete it, countersign it and send it back to the relevant housing authorities (Section 4 (6) of the German Social Housing (Restricted Allocation) Act ).

3. Within this context, we process your personal data in order to meet our legal obligations on the basis of Article 6 (1) sentence 1c GDPR.

2.13. Repair and Damage Reports

1. As an existing tenant, you can use the online customer portal under “My lease agreements/repairs and inquiries,” WhatsApp, Telegram, our chatbot on our website or our service number (tel.: +49 (0) 234 414 700-000) to report repairs. In the event of damage to the rented property, we record the case in order to carry out appropriate repair measures and to report the incident to our insurance companies.

2. Within this context, we process your personal data for the execution of the lease agreement with you on the basis of Article 6 (1) sentence 1b GDPR, on the basis of our legal obligation to maintain the rented property (Section 535 (1) of the German Civil Code) on the basis of Article 6 (1) sentence 1c GDPR and based on our legitimate interest in maintaining and modernizing our properties and settling claims via our insurance companies, on the basis of Article 6 (1) sentence 1f GDPR.

2.14. Claims Processing With Insurance Companies Relating to Rentals

1. In the event of damage, we process your personal data to process and manage insurance policies (such as building insurance, property insurance). The data is processed for the execution of the lease agreement on the basis of Article 6 (1) sentence 1b GDPR, and based on our legitimate interest in asserting and/or enforcing legal claims on the basis of Article 6 (1) sentence 1f GDPR.

2. In the event of a claim that is settled via our liability insurance policy, you will receive a claims report form from us. Among other things, you should enter information on the events leading up to the damage in this form. The report form will then be sent to our insurer. Within this context, your personal data will be processed in order to execute the lease agreement with you on the basis of Article 6 (1) sentence 1b GDPR.

2.15. Modernization in Response to Tenant Request

If you have a modernization request, you can contact Vonovia and obtain a quote from us where appropriate. We process your personal data when you contact us, when we prepare quotes and when we carry out the modernization work. The data is processed for the execution of the lease agreement with you on the basis of Article 6 (1) sentence 1b GDPR, and based on our legitimate interest in being able to offer our tenants modernization measures on request, on the basis of Article 6 (1) sentence 1f GDPR.

2.16. Application for Construction Subsidies Submitted to the Long-Term Care Fund

You can apply to your long-term care fund to receive construction subsidies for certain construction measures at/in your property. If you authorize us to do this by way of an assignment notice, we will submit an application for the subsidy to your long-term care fund on your behalf when the construction work is carried out. The fund will then transfer the subsidy directly to us. Within this context, we process your personal data on the basis of the assignment notice, in which you authorize us to submit an application for the subsidy to your long-term care fund, on the basis of Article 6 (1) sentence 1b GDPR.

2.17. Application for Subletting

1. If you wish to sublet your property as a tenant, you can submit a corresponding application to us. We process your personal data and the personal data concerning the (future) subtenant on the basis of Article 6 (1) sentence 1b GDPR in order to process your application and based on our legitimate interest in being able to confirm the identity of the potential subtenant within the context of our consent to subletting, on the basis of Article 6 (1) sentence 1f GDPR.

2. In individual cases (such as in cases involving water damage or to perform repair work), it may be necessary for us and any craftsmen we commission to have access to the property. In such cases, we may contact you and ask you to provide us with the contact details of your subtenant. Within this context, we process your personal data and the data concerning your subtenant in order to fulfill our obligations under the lease agreement and to maintain the apartment, on the basis of Article 6 (1) sentences 1b and 1c GDPR.

3. If you provide personal data concerning your (future) subtenant, please make sure that you have provided the subtenant with sufficient information about the processing of their data by Vonovia and that you are authorized to make the data available.

4. In all other respects, the provisions of this Privacy Policy apply accordingly to subtenants insofar and to the extent that they relate to tenants.

2.18. Customer Service

1. If you have any questions about Vonovia, our properties or services, require assistance in finding a property, would like to arrange viewing appointments, or if you are a tenant and have questions regarding your lease agreement, you can contact our customer service. You can make your inquiries by phone, WhatsApp, Telegram, via our chatbot on our website, in writing or via the online customer portal. We process your personal data depending on the subject of your inquiry. We may also use personal data stored in our systems in connection with other data processing operations (e.g., data that you provided when arranging a viewing appointment with us or when concluding a lease agreement with us).

2. Depending on your inquiry, your personal data is processed for the purpose of initiating, executing or, where appropriate, terminating the agreement with you on the basis of Article 6 (1) sentence 1b GDPR, to fulfill our legal obligations towards you on the basis of Article 6 (1) sentence 1c GDPR and/or based on our legitimate interest in responding to your inquiry on the basis of Article 6 (1) sentence 1f GDPR.

3. If you send us health-related data in connection with your inquiry, we only process this personal data insofar as this is necessary to respond to your inquiry and insofar as you have granted us your explicit consent in this regard within the meaning of Article 6 (1) sentence 1a GDPR.

4. If you use WhatsApp or Telegram, the privacy policies of the messenger service/social network you are using apply. For further details, please refer to the corresponding privacy policies:

2.19. Informational Emails About Properties and Services on Offer to Existing Tenants

After you conclude your lease agreement with us, we will, in the future, send you informational emails about similar properties and services offered by Vonovia Immobiliengruppe to the email address you have provided. We process your data based on our legitimate interest in advertising our products and services on the basis of Article 6 (1) sentence 1f GDPR and Section 7 (3) of the German Unfair Competition Act (UWG).

2.20. Customer Surveys

We regularly conduct telephone customer surveys to measure and promote customer satisfaction. If you take part in a customer survey, we process your personal data based on our legitimate interest in improving our products and services to reflect your needs and wishes on the basis of Article 6 (1) sentence 1f GDPR.

2.21. Online Communication

We are represented on various social media channels (currently Facebook, Instagram and Twitter), where we regularly publish reports and photos to provide you with information on us and our products and services. You have the opportunity to react to our posts and to communicate with us on our social media channels. If necessary, we process your personal data within this context on the basis of our legitimate interest in responding to your comments/questions/suggestions and in advertising our products and services on the basis of Article 6 (1) sentence 1f GDPR.
The privacy policies of the social media channel you are using apply to the use of Facebook, Instagram and Twitter. For further details, please refer to the corresponding privacy policies:

2.22. Warnings and Termination of Your Lease Agreement

If you do not fulfill your obligations under the lease agreement or do not fulfill them adequately (e.g., in cases involving rent arrears), we reserve the right to take measures against you (e.g., by issuing a warning letter or terminating the lease agreement concluded with you). Within this context, we may also process data that was not collected directly from you (such as information that you yourself provided when you concluded your lease agreement), but also data from other sources. This may be the case, for example, if we receive complaints from other tenants on the basis of which we send you a warning or terminate your lease agreement. Within this context, we process your personal data in order to execute and, where appropriate, perform your lease agreement on the basis of Article 6 (1) sentence 1b GDPR.

2.23. Payment Reminders, Legal Advice, Enforcement and Defense of Legal Claims, Sale of Receivables and Corporate Transactions

1. In cases in which we have receivables outstanding (such as outstanding payments), we track these in our receivables management system, evaluate them, contact you by telephone to inform you and, if necessary, send you a payment reminder.

2. If, for example, you do not fulfill your contractual obligations (e.g., rent arrears despite having been issued a payment reminder or improper use of the rented property) and in the context of legal disputes with you, we will engage external lawyers or collection agencies to provide legal advice and to enforce and/or defend our rights. We may also process personal data from other public sources (e.g., credit agencies) within this context.

3. We process your personal data in order to execute and, where appropriate, perform the lease agreement with you on the basis of Article 6 (1) sentence 1b GDPR, and based on our legitimate interest in asserting, enforcing and/or defending our legal interests on the basis of Article 6 (1) sentence 1f GDPR.

4. We may sell our outstanding receivables to factoring companies, which then collect the receivables in their own names. As part of the sale and its preparation, the collection agencies will gain access to data relating to the outstanding receivables. This information also contains personal data. If an outstanding receivable for which you are the creditor is sold, we will notify you accordingly and provide you with information on the recipient, i.e., the new holder of the claim. We process your personal data for the performance of the lease agreement with you on the basis of Article 6 (1) sentence 1b GDPR.

5. In the event of breaches of contract committed by our employees and in cases involving work-related criminal proceedings against our employees, we also engage external lawyers to provide legal advice and to enforce and/or defend our rights. The handling of these cases may also involve processing your personal data. We process your personal data based on our legitimate interest in asserting, enforcing and/or defending our legal interests on the basis of Article 6 (1) sentence 1f GDPR.

6. In connection with a corporate transaction, a risk assessment (due diligence) is performed on the Vonovia Immobiliengruppe company to be sold. Personal data is also processed within this context. The data is processed based on our legitimate interest in having the company to be sold evaluated for the purposes of a sale using a risk assessment, on the basis of Article 6 (1) sentence 1f GDPR.

2.24. Self-Arranged Viewing Appointments

1. If you terminate your lease agreement, you can grant us your consent in the acceptance record so that we can pass on your contact details to potential interested parties for viewing purposes. They can then contact you directly and arrange viewing appointments. You can grant your consent by post or by using the online customer portal under “Find a home.”

2. The prospective tenant undertakes to treat your contact details as confidential, and only to use them for the purpose of viewing properties of Vonovia Immobiliengruppe and for any communication required within this context. Prospective tenants are prohibited from using your contact details for purposes other than those mentioned in Section 2.24. This applies, in particular, to the dispatch of advertising, the inclusion of contact details in address lists or the transmission and sale of contact details to third parties.

2.25. Matching and Sale of Residential Properties: Processing of Personal Data Concerning Prospective Buyers

We also match properties with prospective buyers. If you are interested, you can contact our customer service team by phone or email, or contact us using a contact form on our website (www.vonovia.de). You can opt to make an inquiry regarding a specific property or send us your interest profile for a general inquiry. We process your personal data to respond to your inquiry and to match you with properties. If you decide on a property, we process your personal data for the preparation and conclusion of your purchase agreement. Your data is processed for the initiation and, where appropriate, conclusion of a purchase agreement with you on the basis of Article 6 (1) sentence 1b GDPR, and based on our legitimate interest in responding to your inquiries on the basis of Article 6 (1) sentence 1f GDPR.

2.26. Other Processing Operations

2.26.1. Compliance Audits and Measures and Internal Auditing

1. We document breaches of contract within our Group in order to clarify the facts, point out the breach of contract to the specific employee, issue them with a reprimand if necessary and/or terminate the contract in certain circumstances. The documentation of the breaches of contract may also contain your personal data, depending on the individual scenario surrounding the breach of contract.

2. If there is a suspicion of criminal conduct on the part of the employee, we carry out a special audit to determine the facts of the case, to check whether a criminal offense has been committed and, if necessary, to secure evidence. This may also involve processing your personal data.

3. Your personal data may also be processed in connection with auditing activities at Vonovia.

4. We process your personal data in order to meet our legal obligations on the basis of Article 6 (1) sentence 1c GDPR. In addition, we process your personal data on the basis of our legitimate interests in conducting the audits specified by the Supervisory Board in order to review the processes and efficiency within the Group, to exercise, enforce and/or defend our legal interests and to guarantee the prevention of cases of fraud and misuse within the company, as well as IT and network security within the company, on the basis of Article 6 (1) sentence 1f GDPR.

2.26.2. Press Releases, Reports on Our Events and Photographs

1. We regularly receive media inquiries. In individual cases, these inquiries can also involve personal data (e.g., the name of a tenant). In such cases and in the context of press reports, we process this data based on our legitimate interest in issuing a statement and, if necessary, correcting misrepresentation, on the basis of Article 6 (1) sentence 1f GDPR.

2. We report on our events on a regular basis. Within this context, we also take photos and/or record videos, and save and publish these photos/videos.

3. If the photos/videos do not specifically depict individual event visitors (e.g., portraits), but are photographs of the event in which individuals can only be seen as part of a group/in the background, we process this personal data based on our legitimate interest in documenting and reporting on our events on the basis of Article 6 (1) sentence 1f GDPR.

4. Photos depicting individual persons (such as portraits)/video sequences (such as video recordings including interviews with specific individuals) are processed with the consent of the person concerned within the meaning of Article 6 (1) sentence 1a GDPR. We process photos/video sequences of public figures based on our legitimate interest in informing the public about the event and its content, on the basis of Article 6 (1) sentence 1f GDPR.

3. Storage and Erasure of Your Personal Data

1. If you have only applied to us regarding properties, your data will be stored for 3 months after the withdrawal/rejection of your application by you/us, unless you are still interested in the properties we offer.

2. In addition, we store your personal data for as long and insofar as is necessary for the purposes (Section 2.) for which the data is processed.

3. If and to the extent that your personal data is no longer required for processing, we will only store your personal data as long as you can assert claims against us or we can assert claims against you (statutory limitation period of three years in general, beginning at the end of the year in which the claim arises, e.g., Sections 195, 199 of the German Civil Code).

4. In addition, we store your personal data for as long and insofar as we are legally obliged to do so. Corresponding evidentiary and retention obligations result, among other things, from the German Commercial Code (HGB), the German Tax Code (AO) and the German Money Laundering Act (GwG) (e.g., Section 257 HGB; Section 147 AO). Under these provisions, the retention obligations apply for a period of up to ten years.

4. Categories of Recipients of Your Personal Data

We transfer your personal data to external parties in the form of order processing, as well as to third parties for their own further processing, and also in the context of an internal process within Vonovia Immobiliengruppe, involving divided responsibilities, for the preparation, execution and, if necessary, performance of your lease or purchase agreement and, where appropriate, for the performance and execution of energy agreements (such as electricity or gas, as well as agreements for television, telephone and internet services). The data is transmitted based on our legitimate interest in carrying out internal administrative activities efficiently and involving divided responsibilities, on the basis of Article 6 (1) sentence 1f GDPR.

4.1. Data Processing by External Service Providers – Contract Data Processing

1. As part of the property matching and rental process, we use external IT service providers (e.g., DATASEC information factory GmbH, IBM Deutschland GmbH, AT AG) who provide us, among other things, with platforms, databases or tools for our services (e.g., our website and our customer portal, various contact options or marketing measures) and process personal data for us on our behalf within this context.

2. We use a Microsoft Azure chatbot to answer inquiries from interested parties when the latter are searching for properties and booking viewing appointments, as well as to answer inquiries from tenants. Your personal data is processed for us on our behalf within this context. In connection with the use of Microsoft Azure, your personal data will be transmitted to the U.S. Microsoft Corporation is subject to the EU-U.S. Privacy Shield. This ensures an adequate level of protection for your personal data. You can access the full text of the EU-U.S. Privacy Shield Framework at the following link: 3. We use external service providers (such as IBM and external agencies) that process your personal data for us on our behalf to conduct customer surveys.

4. The external service providers we commission have been carefully selected and commissioned by us in writing. They are bound by our instructions and are checked by us at regular intervals. All systems used to store your personal data that can be accessed by the external services providers are password-protected and only accessible to a select group of persons who require the data for processing purposes that you have authorized. In this regard, we ensure, in accordance with statutory provisions, that when transferring data to, and having data processed by, external service providers, the data is processed, used and, where appropriate, transmitted under the conditions agreed here.

4.2. Transmission of Personal Data to Third Parties

1. We may transfer your personal data to external real estate agents for viewing appointments. The data is transmitted for the purposes of conducting your viewing appointment and initiating an agreement with you on the basis of Article 6 (1) sentence 1b GDPR.

2. When you sign the reservation record, we transmit your personal data to credit rating service providers and address verification companies (Section 2.8.). We transmit your data to infoscore Consumer Data GmbH, Rheinstr. 99, 76532 Baden-Baden, Germany, Creditrefom e.V., address verification companies or comparable service providers for the purpose of obtaining credit ratings, obtaining information for assessing the risk of payment default on the basis of mathematical statistical procedures using address data. This data is transmitted on the basis of Article 6 (1) sentences 1b and 1f GDPR. You can find more information at the following link:

3. If you have issued us a SEPA direct debit mandate for the collection of your rent, including ancillary expenses under the lease agreement, we will transmit your personal data to banks in order to collect the rent, including the ancillary expenses under the lease agreement. Your personal data is transmitted for the execution of your lease agreement with us on the basis of Article 6 (1) sentence 1b GDPR.

4. In cases involving repairs and in the event of damage, we may commission external service providers (such as craftsmen) to carry out the repairs and rectify the damage. Within this context, we may transmit your personal data for the execution of the lease agreement with you on the basis of Article 6 (1) sentence 1b GDPR, based on our legal obligation to maintain the rented property (Section 535 (1) of the German Civil Code) on the basis of Article 6 (1) sentence 1c GDPR and based on our legitimate interest in renovating and modernizing our properties and settling claims via our insurance companies, on the basis of Article 6 (1) sentence 1f GDPR.

5. In connection with construction subsidies, we transfer your personal data to long-term care funds. Within this context, your personal data is transmitted on the basis of the assignment notice, in which you authorize us to submit an application for the subsidy to your long-term care fund, on the basis of Article 6 (1) sentence 1b GDPR.

6. If you apply for a housing eligibility certificate, we will be asked by the housing authorities in the relevant city to fill out a corresponding form. We will send the completed form back to the responsible housing authorities so that you can be issued with a housing eligibility certificate. Within this context, we transmit your personal data in order to meet our legal obligations on the basis of Article 6 (1) sentence 1c GDPR.

7. In certain circumstances, public authorities, utilities companies and network operators may ask us whether you are still one of our tenants. Within this context, we transmit your personal data (surname, first name and new address) to the party making the inquiry, provided that the relevant requirements are met, based on our legitimate interest in answering the inquiries; on the basis of Article 6 (1) sentence 1f GDPR.

8. Some of our properties are for sale. If these are rented out, we transmit the tenant file for the property in question, including the tenant details and a breakdown showing the credit balance in the security deposit account, to the buyer of the property following conclusion of the purchase agreement. In the context of property sales, your personal data will also be transmitted to real estate agents and notaries. We process your personal data in order to fulfill our legal obligations vis-à-vis the buyer when selling our properties on the basis of Article 6 (1) sentence 1c GDPR and based on our legitimate interest in selling our rented properties and carrying out all measures necessary in connection with the sale on the basis of Article 6 (1) sentence 1f GDPR.

9. If you do not fulfill your contractual obligations (e.g., rent arrears despite having been issued a payment reminder or improper use of the rented property) and in the context of legal disputes with you, we may transfer your personal data to credit agencies, external lawyers and possibly to social managers (e.g., when being accompanied to an appointment at a government office) in order to execute and, where appropriate, perform the lease agreement with you on the basis of Article 6 (1) sentence 1b GDPR, and based on our legitimate interest in asserting, enforcing and/or defending our legal interests on the basis of Article 6 (1) sentence 1f GDPR.

10. If you do not fulfill your payment obligations, we will initiate a collection procedure. We will transmit your personal data to collection service providers for the execution of the collection procedure. Within this context, we process your personal data in order to execute and perform the agreement with you on the basis of Article 6 (1) sentence 1b GDPR, and based on our legitimate interest in enforcing our legal claims, including collection, on the basis of Article 6 (1) sentence 1f GDPR.

11. In cases involving the sale of outstanding receivables, we transmit personal data to factoring companies for the purposes of performing the agreement with you on the basis of Article 6 (1) sentence 1b GDPR.

12. In connection with a corporate transaction, we engage external lawyers to carry out a risk assessment (due diligence). We also transmit personal data within this context. The data is transmitted based on our legitimate interest in having the company to be sold evaluated for the purposes of a sale using a risk assessment, on the basis of Article 6 (1) sentence 1f GDPR.

13. Within the scope of special audits regarding suspected criminal conduct by employees and in connection with audit activities, we call upon the services of supporting service providers (such as auditing firms). In order to carry out the audit, we may transmit your personal data in order to comply with our legal obligations on the basis of Article 6 (1) sentence 1c GDPR and based on our legitimate interests in conducting the audits specified by the Supervisory Board in order to review the processes and efficiency within the Group, to exercise, enforce and/or defend our legal interests and to prevent cases of fraud and misuse within the company, on the basis of Article 6 (1) sentence 1f GDPR.

14. Beyond that, we only transmit your personal data insofar as we are subject to a legal obligation to do so. The data is transmitted on the basis of Article 6 (1) sentence 1c GDPR.

5. Legitimate Interests and Objections

1.We process your personal data within the meaning of Section 2 on the basis of our legitimate interests in providing you with information about our products and services on our websites and in ensuring IT security vis-à-vis you when you visit our websites, conducting analyses and improving our website, as well as our products and services, on the basis of these analyses, preventing fraud, informing you about the properties and services we offer and providing you with special functions for this purpose (such as accessing favorites the next time you log in), avoiding payment default on your part, maintaining and modernizing our properties and settling claims via our insurance companies, asserting and/or enforcing legal claims and being able to offer our tenants modernization measures on request, being able to efficiently process invoices and payments, promoting our products and services, improving our products and services to reflect your needs and wishes, responding to your inquiry, responding to your comments/questions/suggestions, preventing cases of fraud and misuse within the company, ensuring IT and network security within the company, having the company to be sold evaluated for the purposes of a sale using a risk assessment, issuing a statement in the event of press inquiries and, if necessary, correcting misrepresentation, selling our rental properties and carrying out all measures necessary in connection with the sale, as well as to carrying out internal administrative activities efficiently and involving divided responsibilities.

You can obtain information on the weighing of interests from

Vonovia Kundenservice GmbH,
Postfach 44784 Bochum, Germany
Tel.: +49 (0) 234 41 47 000-00,
Fax: +49 (0) 234 314 888-4414,
Email: service@vonovia.de

2. If we process your personal data on the basis of these legitimate interests (Article 6 (1) sentence 1f GDPR), you have the right to object, on grounds relating to your particular situation, to the processing of your personal data at any time. We will then no longer process your data for this purpose/these purposes unless we have compelling legitimate grounds that override your interests, or if the processing is necessary for the establishment, exercise or defense of legal claims. Irrespective of the above, you can object to the processing of your personal data at any time without giving reasons in cases involving direct advertising (e.g., newsletters). Please send your inquiry to

Vonovia Kundenservice GmbH,
Postfach 44784 Bochum, Germany
Tel.: +49 (0) 234 41 47 000-00,
Fax: +49 (0) 234 314 888-4414,
Email: service@vonovia.de

3. If you object to data processing, we will process the personal data concerning you collected within this context to answer your inquiry. Your personal data is processed in order to fulfill a legal obligation on the basis of Article 6 (1) sentence 1c GDPR.


6. Consent and Withdrawal of Your Consent

1. If you have granted us your consent regarding the processing of your personal data, you can withdraw this consent at any time. Your withdrawal of consent is effective for the future. The legality of the processing of your personal data up until the time of withdrawal remains unaffected. Please send your withdrawal notice in writing, by telephone or by email to
Vonovia Kundenservice GmbH,
Postfach 44784 Bochum, Germany
Tel.: +49 (0) 234 41 47 000-00,
Fax: +49 (0) 234 314 888-4414,
Email: service@vonovia.de

2. If you withdraw your consent, we will process the personal data concerning you collected within this context to answer your inquiry. Your personal data is processed in order to fulfill a legal obligation on the basis of Article 6 (1) sentence 1c GDPR.

7. Your Rights

1. You may request at any time, in accordance with the GDPR, that we

  • provide you with information about the personal data concerning you that we process (Article 15 GDPR),
  • rectify personal data concerning you that is inaccurate (Article 16 GDPR) and/or
  • erase (Article 17 GDPR), block (Article 18 GDPR) and/or surrender (Article 20 GDPR) your personal data stored by us.


2. Please send your request in respect of Section 7 to

Vonovia Kundenservice GmbH,
Postfach 44784 Bochum, Germany
Tel.: +49 (0) 234 41 47 000-00,
Fax: +49 (0) 234 314 888-4414,
Email: service@vonovia.de

3. If you assert your rights vis-à-vis us, we will process the personal data concerning you collected within this context to answer your inquiry. Your personal data is processed in order to fulfill a legal obligation on the basis of Article 6 (1) sentence 1c GDPR.

4. Without prejudice to your rights under Section 7, you can lodge a complaint with a data protection supervisory authority if you believe that the processing of personal data concerning you by us breaches the GDPR (Article 77 GDPR).

5. In addition, you can view, correct, change and/or delete your data in your profile in the online customer portal under "My profile” and under “My lease agreements.” You can delete your customer profile in the online customer portal at any time and without prejudice to your rights under Section 7.

8. Amendments to This Privacy Policy

1. The provisions of this Privacy Policy (available free of charge at www.vonovia.de/datenschutz), including the cookie information of Vonovia SE (available free of charge at www.vonovia.de/datenschutz), apply in the version valid at the time in question (see status and version of the Privacy Policy).

2. We reserve the right to supplement and amend the content of this Privacy Policy. The updated Privacy Policy applies as of its validity date (see status and version of the Privacy Policy).

3. We will inform you in a timely manner of such amendments and supplements on our website at mein.vonovia.de/datenschutz and, if you are registered in the online customer portal, the next time you log in, by email or by post. You will be given the opportunity to view, print and save the amended Privacy Policy free of charge.