Data Privacy Policy

1. Contact information for data controller and data protection officer

1.1 Responsibility (Controller)

Responsibility as data controller within the meaning of Art. 4 VII GDPR and other data protection laws is held by

hartmann campus GmbH & Co. KG
Maffeistraße 3
80333 Munich, Germany

Telephone: +49 89  540 45 48 50
Fax: +49 89  540 45 48 19

Email:  info@hartmanns-munich.com

1.2 Data protection officer

We have appointed a data protection officer, who can be contacted as follows:

hartmann campus GmbH & Co. KG
Data Protection Officer
Maffeistrasse 3
80333 Munich, Germany

Telephone: +49 89  540 45 48 00
Fax: +49 89  540 45 48 19

Email: datenschutz@hartmanns-munich.com

2.Scopeof this Data Privacy Policy

2.1 Terms and definitions, individuals covered by the Policy

The following terms and definitions apply for the purposes of this Data Privacy Policy. Where masculine forms are used for the purposes of improved readability, the content of the text where they are used applies to all genders. both genders.

Clients and prospective venue hire clients:We process data of companies, organizations, official authorities, etc., which commission us to provide services and/or which rent event space from us.

Vendors/Other contractual partners:We also process personal data of vendors or other contractual partners which we commission to perform tasks such as provision of services or works.

Visitors to our website:Finally, we collect a limited amount of data when you visit our website, i.e. access the site. For more information about our processing of data during your visit to our website, see Section 7 of this Data Privacy Policy.

2.2Content-relatedapplication of this Policy

This Data Privacy Policy applies when you contact us, attend one of our events, or visit our website.

3. General data processing principles

3.1 General principles

We follow the principles of data privacy laws limiting collection and processing of personal data (abbreviated to “data”) to a minimum. We therefore only process personal data where necessary for clearly defined purposes as described in the following (principles of data avoidance and data minimization). Under these principles data processing is only permissible where based on a sufficient legal position or where your consent has been given (principle of lawfulness).

3.2 Description and scope of data processing

3.2.1 Data of clients and prospective venue hire clients

If you are our client or prospective venue hire client, it is necessary for us to collect and use information about you or individuals within your company or organization in order to provide you with services. For this purpose we initially collect, process and use the data you provide to us within the scope of establishing or pursuing business relations. These data comprise in particular:

• Contact details and/or contact details of individual liaisons within your organization, e.g. names, telephone numbers, email addresses
• Contract-related data, e.g. start and end of the contract,
  payment plans, payment terms
• Current addresses, previous addresses, other mailing addresses
• Contractual data, e.g. start and end of contract
• Bank account data, e.g. your account IBAN, BIC, details of your bank
• Tax-relevant data, particularly tax ID, tax number
• Where applicable, other data related to fulfillment of the business relationship
• Data from mail, electronic, and telephone communication between you and us

3.2.2 Data of vendors and other contractual partners

If you are a vendor or other contractual partner of ours, we require some types of data in order to fulfill the contract we have concluded with you. For this purpose we initially collect, process and use the data you provide to us within the scope of establishing or pursuing business relations. These data comprise in particular:

• Master data and contact data, particularly current address, other mailing addresses, telephone numbers, email addresses
• Contract-related data, e.g. start and end of the contract,
  payment plans, payment terms
• Data given in personal identity documents or other identity papers submitted to us
• Bank account data, e.g. your account IBAN, BIC, details of your bank
• Tax-relevant data, particularly tax ID, tax number
• Data from mail, electronic, and telephone communication between you and us
• Where applicable, other data related to fulfillment of the business relationship

3.3 Purposes of data processing

3.3.1 Processing of data of clients and prospective venue hire clients

During collaboration with you, we collect personal data with the purpose of duly implementing contractual agreements with you and ensuring smooth professional relations.

We use information about our clients and prospective venue hire clients for the purpose of fulfilling our contractual obligations. For this purpose, we store and update your data in our database. We may use your data, particularly your contact data, for direct mail advertising of our services and, in individual cases, of special events. In addition, we may use your personal data to establish or exercise our legal rights or defend ourselves against legal claims.

3.3.2 In processing data of vendors and other contractual partners

We collect and process your personal data for the purposes of contact and of fulfilling our contractual obligations towards you. For example, we may process your contact details for the purpose of contacting you, concluding service or works agreements or similar with you, duly fulfilling our contractual obligations, monitoring payment transactions, etc.

For this purpose, we store and update your data in our database. We may use your data, particularly your contact data, for direct mail advertising of our services and, in individual cases, of special events. In addition, we may use your personal data to establish or exercise our legal rights or defend ourselves against legal claims.

4. Lawful basis of data processing

4.1 Data of clients and prospective venue hire clients

4.1.1 Processing based on your consent

We collect and process your personal data based on consent in cases where you have previously given your express consent to data processing in accordance with Art. 6 (1) a GDPR.

Where we do not already use your data for advertising purposes or customer satisfaction surveys based on our legitimate interests (see section 4.2.4 below), we will obtain your express consent to using your data for further advertising purposes.

4.1.2 Processing based on execution or arrangement of a contract

We collect and process your personal and corporate data for the purposes of contacting you and fulfilling our contractual obligations towards you. We process these data on the basis of Art. 6 (1) b GDPR for the purposes of performance of precontractual measures and fulfillment of contractual performance. For example, we may process your contact details for the purpose of contacting you, concluding agreements with you, duly fulfilling our contractual obligations, and monitoring payment transactions.

4.1.3 Processing based on statutory provisions

We are subject to extensive statutory and regulatory provisions, including under fiscal law. Under Art. 6 (1) c GDPR, collection and processing of your personal data are necessary for our fulfillment of statutory requirements based thereon. In addition, we store your personal and corporate data and/or the personal data of individual contacts within your organization and record conversations, discussions, meetings, reports of any vacancies, and the recruitment process.

4.1.4 Processing based on legitimate interests

We may occasionally request you to take part in a client satisfaction survey. Further, we may use your data, particularly your contact data, for direct mail advertising of our services and, in individual cases, of special events. Further, in cases where we have received your email address in connection with a service, we use these data for email advertising of similar services. This applies until such time as you withdraw consent. At all times when we collect your data, we clearly and explicitly refer you to your right to object to processing of your data.

We use these data to the extent described above under the assumption that we have legitimate interests in processing your data, and that such interests override your interests or fundamental rights and freedoms concerning protection of your data. We would like to contact you at regular intervals to survey your satisfaction and send you information about our services which we believe will be of interest to you.

In connection with our client satisfaction surveys, we occasionally commission market research institutes to optimize our services in the interests of our clients. In this context, too, we assume that your interests or fundamental rights and freedoms concerning protection of your data will not be unreasonably impaired.

4.2 Data of vendors and other contractual partners

4.2.1 Processing based on your consent

We collect and process your personal data based on consent in cases where you have previously given your express consent to data processing in accordance with Art. 6 (1) a GDPR.

Where we do not already use your data for advertising purposes based on our legitimate interests (see section 4.3.4 below), we will obtain your express consent to using your data for further advertising purposes.

4.2.2 Processing based on execution or arrangement of a contract

We collect and process your personal data for the purposes of contact and of fulfilling our contractual obligations towards you. We process these data on the basis of Art. 6 (1) b GDPR for the purposes of performance of precontractual measures and fulfillment of contractual performance. For example, we may process your contact details for the purpose of contacting you, concluding agreements with you, duly fulfilling our contractual obligations, and monitoring payment transactions.

4.2.3 Processing based on statutory provisions

We are subject to extensive statutory and regulatory provisions, including under fiscal law. Under Art. 6 (1) c GDPR, collection and processing of your personal data are necessary for our fulfillment of statutory requirements based thereon. In addition, we store your personal data and/or the personal data of individual contacts within your organization and record conversations and meetings.

4.2.4 Processing based on legitimate interests

Further, we may use your data, particularly your contact data, for direct mail advertising of our services and, in individual cases, of special events.

We would like to contact you at regular intervals to send you information about our services which we believe will be of interest to you.

6. Further transfer of your personal data

6.1 Transfer of personal data to processors

We may use contracted processors, e.g. IT service providers, software providers, storage service providers, market research and other research companies etc., in providing our services. Transfer of your data to these processors takes place under strict compliance with non-disclosure obligations and data protection laws. The processors commissioned by us undertake to comply with our confidentiality standards.

6.2 Other external service providers

In addition, we may transfer your data to external service providers which provide services on our behalf, e.g. external consultants (e.g. tax accountants, attorneys, etc.).

6.3 Transfer of data to third countries

We do not transfer data to countries outside the EU or EEA (i.e. third countries) unless compelled to do so by official or judicial order.

7. Informationconcerning processing of your personal data collected from use of our website

7.1 General

The following information provides details of the type, scope, and purposes of our processing of your personal data collected when you use our website. If you are directed to our website from other websites or move to other websites from our website, please ensure you read the data privacy policy in Section 5 of this document.

When you use our website purely for information purposes, i.e. if you do not register or supply us with information by other means, we only collect the personal data sent to our server by your browser. If you would like to view our website, we collect the following data which are technically necessary for us to display our website correctly to you and ensure its stability and security:

• Your IP address and the duration of your visit to our website
• Date and time of access
• Time difference to Greenwich Mean Time (GMT)
• Content of request (concrete page)
• Access status / HTTP status code
• Data volume transferred
• Website from which the request is made
• Browser
• Operating system and user interface
• Language and version of browser software

7.2 The data specified are processed by us for the following purposes:

• Ensuring smooth connection setup of our website
• Ensuring a pleasant user experience for visitors to the website
• Evaluation of system security and stability, and
• Other administrative purposes

The lawful basis for data processing is Art. 6 (1) 1 f GDPR. The above listed purposes of data collection constitute our legitimate interest. We never use the data thus collected to draw conclusions about your individual identity-

In addition, during your visit to our website we use cookies and analysis services. For more information and explanations, see particularly the “Cookies” section of this Data Privacy Policy below.

7.3 Use of our contact form

If you contact us using the contact form, your personal data which you give in the contact form, including any personal contact details you enter there, are stored by us for the purpose of processing your inquiry and answering any subsequent queries. We do not share the data without your permission.

Your consent therefore constitutes the exclusive legal basis for our processing of the data you enter in the contact form (Art. 6 (1) a GDPR). You can withdraw this consent at any time; a simple email message is sufficient for this purpose. Your withdrawal of consent does not affect the lawfulness of data processing performed up to the date of that withdrawal.

The data you have entered in the contact form remain with us until you request us to delete the data or withdraw your consent to storage of the data or until the purpose of storing the data no longer applies (e.g. processing of your inquiry is completed) Compelling legal obligations, particularly retention periods, will remain unaffected.

7.4 Email, telephone or fax inquiry

When you contact us by email, telephone or fax, your inquiry including all personal data therein (name, inquiry) is saved and processed by us for the purpose of responding to your inquiry. We do not share the data without your permission.

Where your inquiry is related to fulfilment of a contract or is required as part of pre-contractual measures, processing of your data takes place on the basis of Art. 6 (1) b GDPR. In all other cases, processing is based on your consent (Art. 6 (1) a GDPR) and/or on our legitimate interests (Art. 6 (1) f GDPR) given that we have a justified interest in efficient processing of inquiries directed to us.

The data you have included in the contact inquiry remain with us until you request us to delete the data or withdraw your consent to storage of the data or until the purpose of storing the data no longer applies (e.g. processing of your inquiry is completed) Compelling legal obligations, particularly statutory retention periods, will remain unaffected.

7.5 Cookies

Our website uses cookies to enable visitors to make use of specific functions of the website and for us to analyze the behavior of visitors to the site.

Cookies are small text files that are saved on your computer. Most of the cookies we use are session cookies, which are erased from your hard drive at the end of your browser session. Other cookies (known as persistent cookies) are stored on your computer and enable us to recognize your computer on your next visit.

You can prevent cookies from being stored by changing your browser settings accordingly. However, please note that in this case you may not be able to use the complete range of functions of this website to their full extent.

If you wish to prevent cookies from being stored on your computer, change your browser settings to deactivate cookies for our website or prevent cookies from being stored on your computer in general You can also erase any cookies stored on your computer by changing your browser settings.

Deactivation of the use of cookies may require a persistent cookie to be stored on your computer. If you erase this cookie, you will have to repeat the deactivation procedure.

We use the following types of cookies on our website:

• Transient cookies, i.e. cookies that are automatically erased when you close your browser. These particularly include session cookies, which save a session ID allowing various requests by your browser to be assigned to the session. This enables us to recognize your computer the next time you visit our website. Session cookies are deleted when you log out or close your browser.
• Persistent cookies are cookies which allow you to configure your browser settings in accordance with your wishes. For example, they permit refusal of third-party cookies or all cookies. However, please note that if you do this, you may not be able to use all the functions of this website.

7.6 Transfer of information to third parties

7.6.1 Third parties

We may also transfer information to third parties which process information on our behalf.

This is designed to support us in operating some internal business processes including email distribution, IT services, and client services. Under our agreements with these third parties, they undertake to process the data securely in compliance with our instructions.

Transfer of personal data to contracted processors only takes place where the processors can offer sufficient guarantee of orderly and secure use of the data and contractually agree to comply with the principles set forth in this Data Privacy Policy and with statutory regulations. We will not inform third parties about your personal data or otherwise transfer the data to them unless such data transfer is required in order for us to provide the contracted performance or unless you have granted your consent for us to do so.

Your data may also be transferred to organizations in other parts of the world. As the data privacy laws in other regions may not match the standards of your home country, we will only transfer data where adequate data privacy is in place to protect the data stored in this country and where the local service provider complies with applicable data protection law at all times. Where specified by law, we will take action to ensure that personal data processed in other countries is subject to the same level of protection as in your home country as a minimum requirement.

We may be obliged by a statutory requirement or court order to provide law enforcement authorities, official authorities, or third parties with information about you. In such cases we will act responsibly and take your interests into account wherever possible in responding to such enquiries. If you have concerns about these agreements to transfer personal data to third parties, please contact us and request us to refrain from processing your personal data.

7.7 Google Analytics

We use Google Analytics, a web analysis service operated by Google Inc. (“Google”). Google Analytics uses "cookies," text files that are saved on users’ computers and allow their use of the website to be analyzed (see above).

The information about users’ visits collected by the cookie is generally transferred to a Google server in the USA and saved there. While the USA does not have the same level of data protection as the EU, Google is a member of EU-U.S. Privacy Shield (see herefor more information) and, in this capacity, undertakes to comply with European data privacy law.

This website has activated IP anonymization, so that Google first abbreviates users’ IP addresses within member states of the European Union or in other signatory states of the Agreement on the European Economic Area. The full IP address will only be transferred to a Google server in the USA and abbreviated there in exceptional cases. We commission Google to use this information to evaluate the behavior of visitors to this website, to compile reports on website activity, and to provide us with further services related to website use and Internet use. These activities supply us with information about user behavior that enable us to optimize our website, products, and services to reflect user needs.

Google will under no circumstances associate the IP address transmitted by your browser within the operations of Google Analytics with other Google data.

You can prevent cookies from being stored by changing your browser settings accordingly. However, please note that in this case you may not be able to use the complete range of functions of this website to their full extent. Users can also prevent Google from recording and processing the data related to their website visit (including their IP address) generated by the cookies by downloading and installing the browser plugin for Google Analytics deactivation (available here). You can deactivate Google Analytics here: tools.google.com/dlpage/gaoptout

For more information on how Google Analytics collects and processes your personal data, see www.google.com/policies/privacy/partners.

8. Your rights

8.1 Overview of your rights

You are under no obligation to provide us with your personal data. However, please note that if you do not, we may not be able to consider you in our services.

With respect to when and to what extent we use your personal data, you have the following rights in particular:

8.1.1 Right of access

You have the right to obtain information about the data stored by the controller, specifically concerning the purposes of the processing and the duration of storage (Art. 15 GDPR).

8.1.2 Right to rectification

You have the right to require the controller to rectify and/or complete any inaccurate or incomplete personal data concerning you in the data undergoing processing. Such rectification shall be performed by the controller without undue delay.

8.1.3 Right to restriction of processing

You have the right to require the controller to restrict processing of your data. This right particularly applies throughout the duration of processing in cases where you have contested the accuracy of the personal data and where you have the right to erasure of the personal data, but request restriction of processing instead. Further, restriction of processing applies in cases where we no longer need the data for the purposes of the processing but you require the data for the establishment, exercise or defense of legal claims, and where the exercise of an objection is a matter of dispute between you and the controller (Art. 18 GDPR).

8.1.4 Right to erasure

You have the right to require the controller to erase your personal data. Under this provision you may request erasure of your data in cases where the controller no longer needs the personal data for the purposes for which they were collected or otherwise processed; where the controller has unlawfully processed the personal data; where you have submitted a justifiable objection to the processing; where you have withdrawn your consent; or where a legal obligation to erase the data applies (Art. 17 GDPR).

8.1.5 Right to data portability

You have the right to receive the personal data concerning you and which you have provided to the controller––unless already erased ––in a structured, commonly used and machine-readable format (Art. 20 GDPR).

8.1.6 Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 (1) e or f GDPR (Art. 21 GDPR). The controller will no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or where the processing serves for the establishment, exercise or defense of legal claims. In cases where you object to use of your data for advertising purposes, the controller will desist from using your data for such purposes.

8.1.7 Right of withdrawal of data privacy consent statement

You have the right to withdraw your data privacy consent statement at any time. Withdrawal of consent does not affect the lawfulness of processing completed on the basis of consent which was granted prior to its subsequent withdrawal.

8.1.8 Right not to be subject to a decision based solely on automated processing, including profiling

You have the right not to be subject to a decision based solely on automated processing––including profiling––which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

1. is necessary for entering into, or performance of, a contract between you and the data controller;
2. is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests;
3. is based on your express consent.

However, such decisions shall not be based on special categories of personal data referred to in Article 9 I GDPR, unless 9 II a or g GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place. With respect to the cases referred to in (1) and (3), the data controller will implement suitable measures to safeguard your rights and freedoms and legitimate interests, and at minimum the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

8.1.9 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your current domicile, your place of work, or the location of the imputed infringement, if you consider that the processing of personal data relating to you constitutes an infringement of the GDPR. The authority with which the complaint is lodged informs the complainant of the progress and outcome of the complaint, including any available judicial remedy, in accordance with Art. 78 GDPR.