Privacy and Cookie Policy

(Short Version)

My Real ID GmbH, based in Munich, Berg-am-Laim-Straße 75a, 81673 Munich, Germany, („My Real ID“, „us“ or „we“) takes the protection of your personal data in connection with your use of our My Real ID Platform ("Platform") very seriously. The categories of the personal data collected from you depend on how you use the Platform.

We process your personal data for the purpose of making our Platform available to you and optimizing this Platform for you. We only do this within Europe and in compliance with applicable data protection laws. You may also use the Platform without providing personal data to us or otherwise leaving personal data with us, especially if you disable cookies and do not register on the Platform. Please note that in this case some functionalities of the Platform may not be available to you.

If you want to learn more about how My Real ID collects, processes and uses your personal data, please click here to read to the Long Version of our Privacy Policy. If you want to obtain further information about the cookies that we use, please click here.

(Long Version)

My Real ID GmbH, based in Munich, Berg-am-Laim-Straße 75a, 81673 Munich, Gernmany, ("us" oder "we") takes the protection of your personal data in connection with your use of our My Real ID Platform ("Platform") very seriously. In order to provide our services on My Real ID, we need some information about you and we will also use cookies. In addition, to use the Platform as intended, it will be necessary for you to post specific information and share this information with other users.

This Privacy Policy ("Privacy Policy") describes how we process your personal data on the Platform. Please ask recipients of your data, e.g. providers of properties, for more information about how they process your data. If you have any further questions, you may contact us by using the contact details provided at the end of this Policy:

Overview

1.Who is responsible for data processing on the Platform?

My Real ID GmbH, based in München, Berg-am-Laim-Straße 75a, 81673 München, („My Real ID“, „us“ oder „we“) is responsible for processing your registration and usage data (e.g. your username, password, when you log in and your cookie data) on the My Real ID Platform (“Platform”).

We host all content for you that you upload, enter, or share on the platform as a prospective client or a provider (e.g. self-disclosure, offerings, rental requests, communication with other users). That means we process this content exclusively upon your request. Therefore, either you – as the individual who provides the information – or the recipient of the information to whom you give the information are the data controller (e.g. the provider that has provided a self-disclosure).

2.Who is the Data Protection Officer?

You can contact the data protection officer of My Real ID at any time by e-mail at datenschutz@myrealid.com.

3.For what purposes do we process Personal Data?

“Personal Data” means any information concerning your personal or material circumstances that may be used to identify you. This includes your name, your email address, your login, but also, for example, the fact that you are looking for or offering an apartment. We collect, process and use (collectively referred to as “process” or “processing”) your Personal Data for the purposes below.

3.1Whenever you visit our Platform

You may surf on the Platform and view all sections that do not require registration without any Personal Data being collected, if you have disabled the use of cookies. For further information about cookies, please see Clause 3.8 below.

3.2Whenever you contact us

Whenever you contact us, we receive your Personal Data. Depending on the communication channel you use (e.g. telephone or email), these data may differ, but may include the following Personal Data: last name, first name, email address, phone number, information about your previous request, if applicable, and any other information you provide to us when you contact us. We process your Personal Data exclusively to deal with your contact request.

We delete these data after completing your contact request and, apart from that, save it only to fulfill our legal archiving duties.

3.3Registration and use of My Real ID as a Prospective Client

When you use My Real ID as a Prospective Client in search of property ("Prospective Client") we will process the following Personal Data:

3.3.1Registration as a Prospective Client

When you register as a Prospective Client on My Real ID, we process the following Personal Data to register you and perform the contract concluded with you ("Registration Details"): last name, first name, gender, email address, date of birth. In the registration process we will assign an identification number (“MRID-ID”) under which you may communicate with Providers.

We delete your Registration Details when you cancel your account with us. Apart from that, we save your usage data only to fulfill our legal archiving duties.

3.3.2Use of the Platform

In addition, we process the following data in relation to your use of My Real ID for the purpose of operating the Platform and ensuring IT security:

• weblogs of our web server;
• login of Prospective Clients and Providers;
• unsuccessful login attempts;
• duration of sessions;
• communications with other users; and
• modifications of the information provided on My Real ID by Prospective Clients and Providers.

We delete your usage data immediately after the end of your session and once it is no longer needed to provide you with our services or for purposes of IT security. Apart from that, we save your usage data only to fulfill our statutory archiving duties.

3.4Registration and use of My Real ID as a Provider

When you use My Real ID to offer property as a provider ("Provider"), we process your following Personal Data:

3.4.1Registration as a Provider

When you register as a Provider on My Real ID, we process the following Personal Data to register you and perform the contract concluded with you ("Registration Details"): last name, first name and email address of the contact person as well as the name and address of the company, and your payment information, if you use My Real ID subject to a charge.

3.4.2Use of the Platform

In addition, we process the following data in relation to your use of My Real ID for the purpose of operating the Platform and ensuring IT security:

• weblogs of our web server;
• login of Prospective Clients and Providers;
• unsuccessful login attempts;
• duration of sessions;
• communications with other users; and
• modifications made to information uploaded to the My Real ID Platform by Prospective Clients and Providers

We delete your usage data immediately after the end of your session, and once it is no longer needed to provide you with our services, or for purposes of the IT security. Apart from that, we save your usage data only to fulfill our statutory archiving duties.

3.5Payments

Certain services on the Platform are subject to a fee. Providers can pay for most fee-based services with My Real ID Credits. Prospective clients can pay using PayPal or a credit card.

3.5.1Purchasing and using credits

When you purchase credits on the Platform, we, acting as data controller, process the following Personal Data solely to process payment:

• last name, first name, MRID account information and order details, payment details (bank account details or credit card information)

When you use MRID Platform Credits, we process the following Personal Data solely to process payment:

• last name, first name, MRID account information and order details, price in credits

3.5.2Purchasing with PayPal

If we offer PayPal as a payment method, the following applies: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg is the data controller. My Real ID only receives the credit of the respective invoiced amount; bank or credit card information remain with PayPal and is not shared with My Real ID.

3.6Newsletter

When you register for our email newsletter, we process the email address provided by you to send you the relevant newsletters. We will process these Personal Data in order to send you news about the Platform as requested – always in compliance with the applicable competition law. You may cancel your subscription to our email newsletter at any time with immediate effect.

We delete your newsletter data immediately after receiving your cancellation. Apart from that, we save your newsletter data only to fulfill our legal archiving duties.

3.7Data on the Platform that we process for you or third parties

We host all content (other than Registration Details) for you that you upload, enter, or share on the platform as a Prospective Client or a Provider (e.g. self-disclosure, offerings, rental requests, communication with other users or use of third party services such as identity verification). This means we process this content exclusively on your behalf or on behalf of third parties. Thus, in such cases, you should also read the respective third party’s privacy policy.

If you use the Platform commercially (not as a private person for your own property) and wish to conclude a data processing agreement, we will conclude such an agreement with you. You can make a separate request for this by emailing datenschutz@myrealid.com.

In detail, this concerns the following situations:

3.7.1Communication with other users

You can communicate with other users on the Platform, e.g. regarding a certain offer. We host content of the communications with other users that you carry out via the Platform. We process these data solely on your behalf.

3.7.2Posting a self-disclosure

The self-disclosure serves the purpose of presenting oneself on My Real ID. Then you can, for example, apply in response to a suitable offer with the self-disclosure. You may include Personal Data about your person, finances, tenant history, and other general information in the self-disclosure. The chances of a successful application increase if you provide a detailed self-disclosure.

For every apartment, Providers can set in advance what information they need from Prospective Clients in the application process using the “Düsseldorfer Kreis” [Düsseldorf Circle] standard or “My Real ID” two-step concept:

3.7.2.1Düsseldorfer Kreis

"Düsseldorfer Kreis" corresponds to the very strict guidelines of data protection law of the Düsseldorf Kreis dated 27 January 2014 for obtaining self-disclosures from prospective tenants.

3.7.2.2“My Real ID” two-step concept

The two-step approach for data transfer from Prospective Clients to Providers of My Real ID can be used individually and in compliance with data protection laws. It takes its bearings from the Düsseldorfer Kreis approach, but leaves more flexibility for both sides. In the two-step approach, the Provider obtains only a partial self-disclosure in the first round of applications – unless the respective Prospective Client chooses otherwise – containing the information necessary for this step (e.g. salary information only in salary categories, no annexes such as salary statements or driver’s license). Then, e.g. after visiting the premises or once a limited number of applications has been shortlisted, the Provider can request the full self-disclosure from the applying Prospective Clients. A Provider will only obtain access to the full self-disclosure when the Prospective Client has manually and expressly granted access to the Provider. The Provider can mark certain data fields in a self-disclosure as “minimal requirement” or “suggested data” in advance and exclude other data fields from the transfer. Thus, none of the Prospective Client’s information is “forced on” the Provider.

On the Platform there is a “standard” for a self-disclosure in a two-step approach. It is not as strict as the guidelines of the Düsseldorf Circle, but still sufficiently respects the provisions of data protection law. This standard can be changed by each Provider for each object as it wishes. In several places, My Real ID points out to Providers to responsibly deal with this function.

3.7.3Other uploads

In some fields you may upload documents as evidence or enter information in free text fields. You upload this information to the Platform so that you or third parties granted access by you have access to it. My Real ID does not use this information for other purposes unless expressly stated in this Privacy Policy or otherwise or you prompted us to do so.

3.7.4Provider content

In addition to your Registration Details, you may wish to upload other Personal Data to your account, which can be viewed by other users. The Personal Data in your profile can be viewed by all registered and non-registered users on My Real ID.

In some cases you may enter information relating to third parties (e.g. brokers for owners of the property). According to the My Real ID Terms of Use you may only do so if you have informed such third parties sufficiently and obtained their prior consent.

3.7.5Publication by Providers on third party platforms

If we publish your offers at your request on a third party platform, we will create a token based on your account login details for the third party platform and save this on our servers. This token shall be saved permanently and shall enable us to access your account on the third party platform.

3.7.6Attention regarding information about third parties (e.g. fellow tenants)

In a few cases you can enter information about third parties, e.g. fellow Prospective Clients, family members or references. However, this information will become visible for all users only when the respective third party has given their consent.

3.7.7Credit report

When applying for an object, you can give the Provider the right to obtain a credit report (via Arvato, Bertelsmann SE & Co. KGaA, Carl-Bertelsmann-Straße 270, 33311 Gütersloh). The report is provided by Arvarto in the form of a three-colour scale, which only the respective Provider is given access to.

As an alternative, you can upload to the Platform a credit report in form of a self-declaration that you obtained yourself, e.g. from Schufa. My Real ID will verify it and will add the Schufa score to the self-disclosure. You can also simply make a self-declaration that you obtained yourself available to the Provider, without verification, together with the self-disclosure.

3.7.8Identity verification

For the self-disclosure you can have your identity verified by a third party service provider (WebID Solutions GmbH, Friedrichstraße 88, 10117 Berlin). To do so, the service provider will compare your appearance (e.g. via webcam) with the ID provided. This verification process is not filed in your user profile or self-disclosure. We only receive the result “okay” or “not okay”, which is then noted in your self-disclosure.

3.7.9When you apply for a property

Your self-disclosure is generally only accessible by you. Only if you grant access to a certain Provider on the Platform in connection with a specific property or for multiple properties this Provider will also have access to your self-disclosure (access to the entire self-disclosure or only a part of it, as selected by you). In the first step of the application process, the Provider cannot print the self-disclosure. The Provider can only save and print the full self-disclosure. The Provider is obligated by us to use the self-disclosure only for this application, unless otherwise agreed upon.

3.7.10Consider the information that you provide!

A comprehensive self-disclosure may make you more attractive to Providers.

Any Information provided in your self-disclosure is entered by you on a voluntary basis. Entering Personal Data is not required for your use of My Real ID. Therefore, please always consider what information you wish to provide.

The information in this Privacy Policy will help you to do so. Furthermore, on the Platform we provide you with relevant information using “mouse over”, info buttons, explanations, and help texts.

3.8Information about cookies

My Real ID uses different types of cookies. You can find an explanation about what cookies are here. These cookies can be separated into two categories: strictly necessary cookies and functional cookies. For a list of the cookies used by us, see the overview in Clause 3.8.3 below.

Neither we nor any third parties will store any additional cookies on your computer, when you visit or use the Platform.

3.8.1For how long are cookies stored on your computer?

You may at any time remove cookies of any type from your computer by deleting the cookies in your browser. Session cookies will remain stored on your computer only until you close the browser. Persistent cookies will remain stored on your computer until they expire or are deleted by you (e.g. by your targeted deletion of the cookies via your browser settings). For the duration of storage of the particular cookies, please see the overview in Clause 3.8.3.

3.8.2How to manage cookies

3.8.2.1Consent

Strictly necessary cookies are necessary for enabling us to provide the Platform to you. We store strictly necessary cookies on your computer without your prior consent in compliance with the applicable data protection law.

The functional cookies set by us facilitate your use of the Platform and offer to you more convenience, e.g. by keeping you logged in to the Platform. These cookies are stored by us only if you have consented to the use of cookies.

You consent to the use of cookies if you continue to surf on the Platform after having been informed by us about the use of cookies.

3.8.2.2Browser configuration

You may also configure the settings of your browser used to access the Platform so that the browser either accepts or refuses cookies. For a detailed guidance on how to do this, please follow the instructions in your browser, e.g. under “Settings”. Please note that some functions or areas of the website may be not available, if your browser does not accept cookies. For more information on how to change your browser settings visit www.allaboutcookies.org.

3.8.3Overview of the cookies used by My Real ID:

3.8.3.1Strictly necessary cookies

3.8.3.2Functional cookies

Functional cookies enable us to provide the functions and contents of the webpage tailored to your specific needs as these cookies store your preferences. For example, these cookies can be used to store your usage data on the Platform or to store your choice of language. In addition, these cookies can be used to offer interactive information, such displaying the location of a property.

3.9Use of Google Maps

We use Google Maps API Tools on thePlatform. These Tools from Google are used to provide the Platform and associated services, such as the auto-complete function for addresses or proximity search function. When using Google Maps, users' IP addresses will be collected and processed by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for each information request and where information is provided through Tools (e.g. address and map data). We have no control over how your IP address is processed. You can find out how Google processes your Personal Data, and how you can object to such processing, in the Google Privacy Policy available at http://www.google.de/intl/de/policies/privacy/ and https://www.google.com/policies/privacy/partners/?hl=de to obtain information on how Google handles your personal data.

You can also prevent your IP address being processed by deactivating JavaScript in your browser or by installing a JavaScript blocker e.g. 'NoScript' (www.noscript.net). This may result in reduced functionality on the Platform. Many functions, such as the address auto-complete function, will not be able to be used.

4.What is the legal justification for the data processing on the Platform?

We process your Personal Data either to fulfill contractual obligations (Operation of the Platform) or with your consent.

5.Does My Real ID transfer Personal Data to third parties?

5.1You decide who has access to your data

You decide who receives your self-disclosure. A data transfer from My Real ID to other users or platforms shall take place only if the respective user requests My Real ID to do so. This is in particular the case if you, as a Prospective Client, grant access to your (partial or full) self-disclosure to a specific Provider in the application process for a certain property or communicate with this Provider via the Platform. The data protection control in this case is up to you.

Please also always observe the information fields and buttons on the Platform that give you additional information at the relevant place.

5.2Offers on third-party platforms

If necessary, My Real ID publishes offers from Providers on third party platforms. To do so, My Real ID transfers relevant Personal Data to the operator of the third-party platform according to its requirements. Providers can delete such offers at any time. However, we do not have any control over how long data from offers deleted on our Platform remain with the operator of the third party platform. Please read the third party provider’s privacy policy to find out more about the data processing by the third party provider.

5.3No data transfers

Apart from the data exchange controlled by you as described in this Privacy Policy, we do not disclose or transfer your Personal Data to third parties, unless you agreed to this transfer or disclosure beforehand, e.g. when applying for a property, or we informed you in another manner.

5.4Use of service providers

We use service providers that assist us in operating My Real ID. Please read the clarifications about this above under Clause 3.7 (Data on the Platform that we process for you or third parties).

These include the following service providers with whom My Real ID GmbH has also concluded order data processing agreements:

• HETZNER AG for hosting the website, data and infrastructure
• All-Inkl.com – Neue Medien Münnich for the provision of e-mail services
• sipgate GmbH for the provision of telephone services
• Digital1 GmbH for the provision of IT consulting and services

6.How long do we process your data and when do we delete them?

We will delete or block your Personal Data, once we do not need it any longer for any of the above purposes for which we have collected or received them, unless we are required to do so by law. For more details see the processing purposes in Clause 3 (For what purpose do we process Personal Data?) above.

If you cancel your account with us, your account will be blocked after the date of cancellation and will no longer be accessible to other users. In this event, we will only process your relevant Personal Data to perform our contractual obligations and any statutory archiving obligations. We will then irreversibly delete your Personal Data.

7.Your statutory rights; how to contact us

You are entitled at any time to request information about your Personal Data that we store and request us to correct, delete or block your Personal Data or object to the processing of your data. An objection to data processing only applies to the future and may require that the contractual relation between us to be terminated – because without processing your registration or usage data we cannot fulfill the contractual relation with you.

You may also, at any time, withdraw any consent given with effect for the future.

If you wish to do so, or have any other question relating to data protection in connection with the website or the Platform, please contact us using the contact details set forth under Clause 1 above or by sending an email to datenschutz@myrealid.com.

---

Letzte Änderung: July 2017

Rechtsberatung: Reed Smith LLP München