IMPrint

ERH1 GmbH & Co. KG
Waltherstraße 23
80337 Munich
Phone: +49 89 7411 889 50
E-Mail: info@loestshof.de

Managing Director: Martina Dambacher
Munich Local Court HRB 230939
Responsible for content: Martina Dambacher

Corporate Design + Website
Corporate Creation GmbH
Jahnstrasse 3
80469 Munich
www.corporatecreation.de

DATa protection declaration

As of March 2023

1. Name and address of responsible party
2. Contact details of data protection entity
3. General remarks on data processing
4. Rights of data subject
5. Use of cookies
6. Contact via email
7. Contact form
8. Applications via email and application form
9. Corporate presence on online employment platforms
10. Registration

1. Name and address of responsible party

Responsible in accordance with the data protection act (GDPR) and other data protection regulations is:

ERH1 GmbH & Co. KG
Waltherstraße 23
80337 München
Germany
+49 89 741188950
info@loestshof.de
www.loestshof.de

2. Contact details of data protection entity

The data protection officer of the party responsible is:

DataCo GmbH
Dachauer Straße 65
80335 München
Germany
+49 89 7400 45840
www.dataguard.de

3. General remarks on data processing

1. Scope of processing of personal data

On principle, we only process personal user data to the extent necessary to ensure  the full functionality of this website and provide content and services. The processing of personal user data requires the consent of the user. An exception applies only in such cases in which it is not possible to obtain prior consent for actual reasons and data processing is mandatory for statutory provisions.

2. Legal basis for the processing of personal data

Provided we obtain the consent for the processing of personal data by the person concerned, Article 6 Section 1 Sentence 1 Letter a) GDPR serves as the legal basis.

Article 6 Section 1 Sentence 1 Letter b) GDPR serves as the legal basis for the processing of personal data required to fulfill a contract to which the data subject is a party. This also applies to processing operations necessary to carry out pre-contractual measures.

Insofar as processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Article 6 Section 1 Sentence 1 Letter c) GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Article 6 Section 1 Sentence 1 Letter d) GDPR serves as the legal basis.

If the processing is vital to safeguarding a legitimate interest of our company or a third party and if the interests, fundamental rights and fundamental freedoms of the person concerned do not outweigh the prior interests, Article 6 Section 1 Sentence 1 Letter f) GDPR serves as the legal basis for the processing.

3. Data deletion and storage period

The personal data of the subject concerned will be deleted or blocked as soon as the original purpose of storage no longer applies. Data may also be stored if requested by the European or national legislator in EU regulations, laws or other regulations to which the person responsible is subject. The data will also be blocked or deleted if a storage period mandated by the standards mentioned expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

4. Rights of data subject

If your personal data is being processed, you are the data subject within the legal framework of the GDPR and may claim the following rights from the responsible party:

1. Right to information (Art. 15 GDPR)

You are legally entitled to request a confirmation from us as to whether your personal data is being processed.

If this is the case, you have the right to information about the respective data and the following details:

* Processing purposes
* Categories of personal data
* Recipients or categories of recipients
* Planned storage period or criteria for determining this period
* Confirmation of rights to amendment, deletion, restriction or objection
* Right of appeal to the competent supervisory authority
* Where applicable, origin of data (if provided by a third party)
* If applicable, information on the use of automated decision-making, including profiling, and any significant information about the logic involved, the scope and the expected effects
* Where applicable, an indication of transfers of personal data to a third country or international organization

2. Right to amendment (Art. 16 GDPR)

If your personal data proves to be incorrect or incomplete, you have the right to request an immediate correction or amendment of the personal data.

3. Right to restriction of data processing (Art. 18 GDPR)

If one of the following conditions is met, you have the right to demand that the processing of your personal data be restricted:

* You contest the accuracy of your personal data for the period of time that enables us to verify the accuracy of the personal data.
* In case of unlawful processing, you reject the deletion of the personal data and request that the use of the personal data be restricted instead.
* We no longer need your personal data for the purpose of processing, but you need your personal data to assert, exercise or defend your legal claims or
* after you have lodged an objection to the data processing, for the duration of reassessing whether our legitimate reasons outweigh your reasons for objection.

4. Right to data deletion (“Right to be forgotten”) (Art. 17 GDPR)

If one of the following reasons applies, you have the right to demand the immediate deletion of your personal data:

* Your data is no longer necessary for the processing purposes for which it was originally collected.
* You revoke your consent and there is no other legal basis for the processing.
* You object to the processing and there are no overriding legitimate reasons, or you object in accordance with Article 21 Section 2 GDPR.
* Your personal data is being processed unlawfully.
* The deletion is mandatory for compliance with legal obligations under union or member state law to which we are subject.
* The personal data was collected in relation to information society services offered in accordance with Article 8 Section 1 GDPR.

Please note that the reasons listed above do not apply if data processing proves necessary

* to exercise the right to freedom of expression and information.
* to fulfill a legal obligation or to perform a task that is in the public interest and to which we are subject.
* for reasons of public interest in the field of public health.
* for archiving purposes in the public interest, scientific or historical research purposes or for statistical reasons
* to assert, exercise or defend legal claims.

5. Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, common and machine-readable format or to request transmission to a third party responsible.

6. Right to object to certain data processing (Article 21 GDPR)

In accordance with Article 6 Section 1 Sentence 1 Letters e) or f) GDPR you have the right to object to the processing of your personal data at any time, for any reason arising from your individual situation. This also applies to any kind of profiling based on these provisions.

If the personal data concerning you is processed to carry out direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.

7. Right to file a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The supervisory authority to which the complaint was lodged will inform the complainant about the status and the results of the complaint, including the possibility of a judicial remedy under Article 78 GDPR. A list of the supervisory authorities locally responsible in Germany can be found on the website of the Federal Commissioner for Data Protection under the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

You have the right to complain to a data protection supervisory authority about the processing of your personal data. Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna phone: +43 1 52 152-0 Email: dsb@dsb.gv.at

5. Use of cookies

1. Type and scope of data processing

When you visit our website, we use technical aids for various functions, in particular cookies, which may be stored on your end device. When you visit our website and at any time thereafter, you can choose whether you want to generally allow the setting of cookies or which specific additional functions you want to select. You can make changes in your browser settings or via our consent manager. Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using, so that certain information is available to the entity that sets the cookie. Below we describe what kind of cookies we use:

We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website cannot be displayed (in full) or certain support functions will not be available.

The following data is stored and transmitted by the technically essential cookies:

* Language settings
* Number of page views
* Use of website functions

We also use cookies on our website that are not technically essential. Technically unnecessary cookies are text files that not merely serve the functionality of the website, but also collect other data.

By setting cookies that are not technically essential, the following data is processed:

* IP address
* Location of internet users
* Date and time of website access

2. Purpose of data processing

The purpose of using technically essential cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these it is necessary that the browser is still recognized after accessing a different page.

The following applications rely on technically essential cookies:

* Adopting language settings
* Functionality of the website

Cookies that are not technically necessary are used for the purpose of improving the quality of our website, its content and thus our reach and profitability. By setting these cookies, we learn how the website is used and accordingly can continuously optimize our service. In particular, we use these cookies for the following purposes:

Tracking to collect data like the location of internet users.

3. Legal basis for data processing

The provisions of the Telekommunikation-Telemedien-Datenschutz-Gesetz (TTDSG, i.e. Telecommunications Telemedia Data Protection Act) apply to the storage of information in the end user’s terminal equipment and/or access to information already stored in the end user’s terminal equipment. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your end device is based on Section 25 Point 2 No. 2 TTDSG. Storage of and access to the information on your end device serves the purpose of making it easier for you to use our website and to enable us to offer you our services exactly as you have requested them. Some functions of our website also do not work without the use of these cookies and would therefore not be available to you. Cookies are generally deleted after the end of the session (e.g. logging out or closing the browser) or after a specified period of time has expired. Information about deviating storage periods for cookies can be found in the following sections of this data protection declaration.

If cookies are used that are not technically essential, this is done only with your express consent, which you can give via the cookie banner. In this case, the basis for storing and accessing information is Section 25 (1) TTDSG in conjunction with Article 6 Section 1 Letter a), Article 7 GDPR. You may revoke your consent at any time with effect for the future or give it back later by configuring your cookie settings accordingly. Alternatively, you can prevent the storage of cookies though the appropriate settings in your browser software. Please note that your browser settings only apply to the specific browser you are using. If personal data is processed after the storage of and access to the information on your terminal equipment, the provisions of the GDPR apply. Further Information on this can be found in the following sections of this data protection declaration.

6. Email contact

1. Type and scope of data processing

You are free to contact us via the email address provided on our website. In this case, the user’s personal data transmitted with the email will be stored.

The data will only be used to process the current conversation.

2. Purpose of data processing

If contact is made by email, this also constitutes the necessary legitimate interest in the processing of the data.

3. Legal basis for data processing

The legal basis for the processing of the data transmitted when sending an email is Article 6 Section 1 Letter f) GDPR. Our legitimate interest is to respond to the inquiry transmitted by you via email in the best way possible.

If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6 Section 1 Letter b) GDPR.

4. Duration of data retention

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were originally collected. For the personal data sent by email, this applies when the respective conversation with the user has ended. The conversation is concluded when it can be inferred from the circumstances that the issues in question have been finally clarified.

Any additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5. Possibility of objection

If the user contacts us by email, she or he can object to the storage of her or his personal data at any time. In this case, the conversation can and will not be continued.

Please request via email.

All personal data that was saved in the contacting process will be deleted in this case.

7. Contact form

1. Type and scope of data processing

Our website contains a contact form which can be used to contact us electronically. If a user chooses this option, the data entered in the input mask will be transmitted to us and stored.

At the time your message is sent, the following data is stored:

* Email address
* Last name
* First name
* Address
* Phone number (landline/mobile)
* Date and time of contact

2. Purpose of data processing

The processing of the personal data from the input mask of the contact form or via our email address provided serves us solely to process the contact.

All other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

3. Legal basis for data processing

The legal basis for the processing of data transmitted via email is Article 6 Section 1 Sentence 1 Letter f) GDPR. Our legitimate interest is to answer the inquiry you send to us via the contact form to the best of our abilities. If the email contact is aimed at concluding a contract, the additional legal basis for the processing is Article 6 Section 1 Sentence 1 Letter b) GDPR.

4. Duration of data retention

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were initially collected. For any personal data drawn from the input mask of the contact form and those transmitted via email, this applies when the respective conversation with the user has ended. The conversation is considered as terminated when it can be inferred from the circumstances that all issues in question have been finally resolved.

The additional personal data collected during the transmission process will be deleted after a period of seven days at the latest.

5. Possibility of objection

If the user contacts us via the input mask in the contact form, she or he can object to the storage of her or his personal data at any time.

Please request via email.

All personal data stored during contact will be deleted in this case.

8. Job application by email and application form

1. Scope of personal data processing

Our website contains an application form that may be used for electronic applications. If an applicant makes use of this service, the data entered in the input mask will be transmitted to us and stored. This applies to:

* Gender
* First name
* Last name
* Address
* Phone (landline and/or mobile)
* Email address

Alternatively, you can submit your application by email. In this case, we will store your email address and any data relevant to us provided with this email.

After submitting your application, you will receive an email from us confirming receipt of your application documents.

Your data will not be passed on to third parties. The data will exclusively be used to process your application.

2. Purpose of data processing

The processing of the personal data from the application form serves us solely to process your application. If contact is made by email, this also constitutes the necessary legitimate interest in the processing of the data.

All other personal data processed during the sending process serve the prevention of misuse of the application form and to ensure the integrity of our information technology systems.

3. Legal basis for data processing

The legal basis for the processing of your data is a prospective employment contract, initiated by the request of the person concerned, Article 6 Section 1 Sentence 1 Letter b) Alternative 1 GDPR and Paragraph 26 Section 1 Point 1 BDSG.

4. Duration of data retention

After completion of the application process, your data will be stored for up to three months. Your data will be deleted after three months at the latest. In the event of a legal obligation, the data will be stored within the framework of the applicable provisions.

Any additional personal data collected during the submission process will be deleted after a period of seven days at the latest.

9. Use of company profiles in job-oriented networks

1. Scope of data processing

Our company appears in job-oriented networks. We maintain a corporate presence on the following professional networks:

LinkedIn:

LinkedIn, Unlimited Company Wilton Place, Dublin 2, Ireland

XING:

XING SE, Dammtorstraße 30, 20354 Hamburg, Germany

On our site we provide information and offer users the opportunity to communicate with us.

The corporate presence is used for applications, information/PR and active sourcing.

We cannot provide any information on the processing of your personal data by the companies co-responsible for our corporate presence. Further information is provided in the data protection declaration of:

LinkedIn:

https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

XING:

https://privacy.xing.com/de/datenschutzerklaerung

When interacting with our corporate presence (e.g. comments, posts, likes, etc.), you may possibly make personal data (e.g. real name or photo of your user profile) public.

2. Legal basis for data processing

The legal basis for processing personal data for the purpose of communicating with customers and interested parties is Article 6 Section 1 Sentence 1 Letter f) GDPR. Our legitimate interest is to process your inquiry to the best of our abilities or to be able to provide the information requested. If contact is aimed at concluding a contract, the additional legal basis for processing is Article 6 Section 1 Letter b) GDPR.

3. Purpose of data processing

Our corporate identity serves to inform users about our services. Any user is free to publish personal data through her/his activities.

4. Duration of data retention

We store your activities and personal data published on our company website until you revoke your consent. In addition, we comply with the statutory retention periods.

5. Possibility of objection

You can object to the processing of your personal data collected by us when you use our company website at any time and assert your data subject rights mentioned under IV. of this data protection declaration. To do this, simply send us an informal email to the email address given in this data protection declaration.

You can find more information on how to exercise your rights here:

LinkedIn:

https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

XING:

https://privacy.xing.com/de/datenschutzerklaerung

Hosting

Our website is hosted on servers by a service provider commissioned by us.

This service provider is:

domainfactory GmbH, Oskar-Messter-Str. 33, 85737 Ismaning, Germany

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The information stored is:

* Browser type and version
* Operating system in use
* Referrer URL
* Host name of accessing computer
* Date and time of server request
* IP address

This data will not be merged with other data sources. This data is collected in accordance with Article 6 Section 1 Letter f) GDPR. Our legitimate interest in processing this data is to display our website correctly and to optimize its functions.

The geographic location of the website’s server is in Germany.

10. Registration

1. Type and scope of data processing

On our website users are provided with a registration form prompting personal data. The data is entered into an input mask, transmitted to us and stored. We will not transfer any data to third parties. The following data is collected as part of the registration process:

* Email address
* Last name
* First name
* Address
* Phone number (landline/mobile)

As part of the registration process, the user’s consent to the processing of this data will be obtained.

2. Purpose of data processing

User registration is required for the provision of certain content and services on our website.

Entering into a tenancy.

3. Legal basis for data processing

The legal basis for processing the data is Article 6 Section 1 Sentence 1 Letter a) GDPR if the user has given her or his consent.

4. Duration of data retention

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were originally collected.

This is the case for the data collected during the registration process if the registration on our website is canceled or changed.

5. Possibility of withdrawal after consent

As a user, you have an option to cancel the registration at any time. Data stored about you can be changed at any time upon your request.

Please request deletion/alteration via email.

This privacy statement was created with the support of DataGuard.