Privacy notice for tenants

This English version is provided for convenience only. In the event of any discrepancy, the German version shall prevail.

Privacy notice pursuant to Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR) for tenants of properties that ServiceInvest Kapitalverwaltungsgesellschaft mbH holds, directly or through property companies, for the account of the investment funds (Sondervermögen) it manages.

Preliminary remarks

This notice informs you about how we process your personal data and which rights you have under data protection law. In this document, “we” refers to ServiceInvest Kapitalverwaltungsgesellschaft mbH (hereinafter “ServiceInvest”), acting for the account of the investment fund managed by us that is the landlord or (indirect) owner of the property on the basis of which we process your data (hereinafter the “Property”).

Personal data means any information that can be related to you personally (Art. 4(1) GDPR), for example your name, address and email address, but also tax data and bank account details, including the corresponding data of persons acting on your behalf.

We receive these data directly from you or from the property manager engaged to manage the Property, from the asset manager or from other service providers. We process them in our capacity as landlord or beneficial owner of the Property and as the asset management company of the investment fund.

1. Name and contact details of the controller and of the data protection officer

The controller within the meaning of Art. 4(7) GDPR for the processing of the personal data that we collect in connection with the letting of the Property or that are passed on to us is:

ServiceInvest Kapital­verwaltungs­gesellschaft mbH
acting for the account of the investment funds it manages
Fürstenrieder Straße 61
80686 München
Email: datenschutz@serviceinvest.de
Represented by the managing directors: Jörg Homann, Jürgen Preißinger, Matthias Wiffler, Johannes Zahn

You can reach our data protection officer at:

Sascha Kremer
c/o KREMER LEGAL
Bahnhofstraße 66
41236 Mönchengladbach
sascha.kremer@kremer.legal

Current information on data protection can be found at any time in our privacy policy at www.serviceinvest.de.

2. Categories of data, purposes and legal bases of processing

We process your personal data in accordance with applicable data protection law, in particular the GDPR and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), for the following purposes.

a) Performance of a contract or implementation of pre-contractual measures (Art. 6(1)(b) GDPR)

We process personal data in connection with the letting of the Property, or of parts of the Property, to you. In doing so, we act for the account of the investment fund in which institutional investors hold an economic interest. The processing serves the preparation, conclusion, performance and termination of your lease. We process the following data:

• data relating to you and to persons acting on your behalf, such as representatives and contact persons (first name and surname, date of birth, place and country of birth, nationality, marital status, occupation);
• where applicable, data from your identity card or passport;
• contact details (address, previous residential or business address, email address, telephone number);
• consumption data and service charges;
• bank account and payment data;
• where applicable, information on creditworthiness;
• data from the lease;
• correspondence during the tenancy.

As a rule, we do not collect these data from you ourselves; they are transmitted to us by the property manager engaged for the respective property or by the asset manager. Depending on the contractual arrangements, the respective property manager processes your data on our behalf (Art. 28 GDPR) or as a controller in its own right (Art. 4(7) GDPR); in the latter case, it will inform you separately about its processing. Data may also be collected directly from you or passed on by other service providers engaged in connection with the tenancy. Where necessary for the purposes stated, we also collect data from third parties, for example from credit reference agencies if rent is not paid or letters cannot be delivered, or from publicly accessible sources such as the commercial register or the residents’ register.

b) Compliance with legal obligations (Art. 6(1)(c) GDPR)

Where necessary, we process your data to comply with statutory obligations, in particular:

• for notifications to building, registration, tax and supervisory authorities and for other purposes required under supervisory law;
• for identification and the further due diligence obligations under the German Anti-Money Laundering Act (Geldwäschegesetz, GwG), in accordance with the statutory requirements and our internal safeguards;
• for bookkeeping and record-retention obligations under commercial and tax law;
• where we are obliged to disclose data on the basis of a court decision or an order issued by an authority, or where data must be disclosed in the context of official or judicial proceedings for the purposes of taking evidence, criminal prosecution or the enforcement of civil-law claims (for example to a court or a public prosecutor’s office).

In addition, we are obliged under the German Investment Code (Kapitalanlagegesetzbuch, KAGB) to have the Property valued regularly. For this purpose, we generally transmit only anonymised information to the valuation firm.

c) Protection of legitimate interests (Art. 6(1)(f) GDPR)

We also process your data where this is necessary to protect our legitimate interests or the legitimate interests of third parties and your interests worthy of protection do not override them:

• Where required, we collect creditworthiness data in order to reduce the risk of rent defaults.
• The investors in the investment fund and, where applicable, the property companies have an interest in information on the letting of the Property, for example on leases, consumption data and service charges. We provide this information in anonymised form only.
• For the valuation of the Property by an external valuation firm, the disclosure of certain personal data may be necessary in individual cases.
• In the event of a planned sale or financing of the Property, we provide prospective purchasers, acquirers and financing banks, as well as their advisers, with the information they require for their due diligence. As far as possible, we limit this to anonymised or pseudonymised information and disclose it only subject to a confidentiality undertaking.
• We process data where this is necessary for the establishment, exercise or defence of legal claims.

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

3. Processing of special categories of personal data

Where necessary, we may process the biometric data contained in copies of your identity documents that you may provide to us (photograph).

This processing is carried out to comply with our obligations under anti-money laundering law, which we are required to do by law (Art. 6(1)(c) and Art. 9(2)(g) GDPR in conjunction with the provisions of the GwG).

4. Recipients of the personal data

Within our company, only those employees who need your data for the purposes stated have access to them; access is governed by a tiered authorisation concept.

For the purposes stated in section 2, and only where there is a legal basis for doing so, we also disclose your data to the following recipients:

• the property manager engaged for the Property and the asset manager of the Property;
• service providers who support us, such as IT service providers and external data centres, as well as affiliated companies that provide services for us;
• the depositary of the investment fund;
• auditors, tax advisers and lawyers;
• valuation firms and experts;
• authorities and other public bodies, such as tax authorities, the Federal Financial Supervisory Authority (BaFin), courts and law enforcement authorities, where we are obliged to do so;
• in the event of a sale or financing of the Property: prospective purchasers, acquirers and financing banks, as well as their advisers.

We contractually oblige service providers acting on our behalf to take appropriate technical and organisational measures to protect your data and to maintain confidentiality. They process your data within the European Union (EU) or the European Economic Area (EEA).

Your data are generally transferred to a country outside the EU or the EEA (third country) only where this is necessary for the performance of the contract concluded with you or for important reasons of public interest, for example to comply with tax reporting obligations.

5. Storage period

We store your personal data for the duration of the tenancy. After the tenancy has ended and all obligations arising from it have been fulfilled, we delete your data unless we are required to retain them further on the basis of retention obligations under commercial, tax or supervisory law. We may also retain your data further where this is necessary to preserve evidence within the statutory limitation periods.

The retention periods under commercial and tax law (§ 257 HGB, § 147 AO) are up to ten years. Records that we have prepared under the German Anti-Money Laundering Act are retained for five years (§ 8(4) GwG). The storage period is also determined by the statutory limitation periods. Under the German Civil Code (Bürgerliches Gesetzbuch, BGB), these are generally three years from the end of the calendar year in which the claim arose, but in certain cases up to thirty years. Once the relevant period has expired, we delete your data.

6. Obligation to provide data and consequences of failure to provide them

There is no general obligation to provide us with personal data. However, the provision of data is in part required by law or necessary for the contract (see section 2). If you do not provide us with data that we need for the contract or on the basis of a statutory obligation, it may not be possible to conclude or perform the lease as intended, or we may have to terminate it.

7. Rights of data subjects

In addition, you may assert the following rights against us:

• right of access (Art. 15 GDPR);
• right to rectification or erasure (Art. 16 and 17 GDPR);
• right to restriction of processing (Art. 18 GDPR);
• right to data portability (Art. 20 GDPR);
• right to withdraw consent given at any time with effect for the future (Art. 7(3) GDPR);
• right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

The right of access and the right to erasure are subject to the restrictions set out in §§ 34 and 35 BDSG. The data protection supervisory authority responsible for us is:

Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA)
Promenade 18
91522 Ansbach
www.lda.bayern.de

To exercise your rights, please contact in the first instance, if possible:

ServiceInvest Kapital­verwaltungs­gesellschaft mbH
Fürstenrieder Straße 61
80686 München
Email: datenschutz@serviceinvest.de

Changes to this notice

The date stated below indicates when this notice was last revised. In the event of material changes, we will provide you with the current version of this privacy notice separately by post or email. You may also request the current version from us at any time.

Last updated: November 2026