1. Data controller

HEIDELBERGRE. GmbH
Rohrbacher Straße 9
69115 Heidelberg
Germany

Represented by: Katharina Onigkeit, Managing Director

Telephone: +49 6223 9721876
Email: study@heidelberg-re.de

2. Security and protection of your personal data

We regard it as our primary duty to safeguard the confidentiality of the personal data you provide and to protect it from unauthorised access. We therefore exercise the utmost care and apply state-of-the-art security standards to ensure maximum protection of your personal data.

As a company governed by private law, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We have implemented technical and organisational measures to ensure that data protection regulations are observed both by us and by our external service providers.

3. Definitions

The law requires that personal data be processed lawfully, fairly and in a manner that is transparent to the data subject (“lawfulness, fairness and transparency”). To ensure this, we inform you of the individual legal definitions that are also used in this privacy notice:

3.1 Personal data

‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

3.2 Processing

‘Processing’ means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3.3 Restriction of processing

‘Restriction of processing’ means the marking of stored personal data with the aim of limiting its processing in the future.

3.4 Profiling

‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

3.5 Pseudonymisation

‘Pseudonymisation’ means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures.

3.6 Data controller

‘Data controller’ means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

3.7 Data processor

‘Data processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

3.8 Recipient

‘Recipient’ means a natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not.

3.9 Third party

‘Third party’ means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.

3.10 Consent

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

4. Lawfulness of processing

The processing of personal data is lawful only if there is a legal basis for it. In accordance with Article 6(1)(a) to (f) GDPR, the legal basis for processing may in particular be that:

  • the data subject has given consent to the processing of their personal data for one or more specific purposes (point (a));
  • processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract (point (b));
  • processing is necessary for compliance with a legal obligation to which the controller is subject (point (c));
  • processing is necessary to protect the vital interests of the data subject or of another natural person (point (d));
  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (point (e));
  • processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (point (f)).

5. Information on the collection of personal data

(1) Below, we provide information on the collection of personal data when you use our website. Personal data includes, for example, name, address, email addresses and user behaviour.

(2) If you contact us by email or via a contact form, the data you provide (your email address and, where applicable, your name and telephone number) will be stored by us in order to answer your enquiries. We delete the data collected in this context once storage is no longer necessary, or restrict its processing if statutory retention obligations apply.

6. Collection of personal data when you visit our website

If you use the website purely for information purposes, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. When you view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (legal basis: Article 6(1), first sentence, point (f) GDPR):

  • IP address
  • Date and time of the request
  • Time zone difference from Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status / HTTP status code
  • Amount of data transferred in each case
  • Website from which the request originates
  • Browser
  • Operating system and its interface
  • Language and version of the browser software

This data is stored in the server log files and deleted after seven days at the latest. It is not combined with other data sources.

7. Hosting

We host our website with Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany (hereinafter ‘Mittwald’). When you visit our website, Mittwald records various log files, including your IP address. The servers are located in Germany. For further details, please refer to Mittwald’s privacy policy: www.mittwald.de/datenschutz.

The use of Mittwald is based on Article 6(1)(f) GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. Where consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR; consent may be withdrawn at any time.

A data processing agreement in accordance with Article 28 GDPR has been concluded with Mittwald.

8. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

9. Use of cookies and consent tool

(1) In addition to the data mentioned above, cookies are stored on your device when you use our website. Cookies are small text files that are stored on your hard drive, assigned to the browser you use, and through which certain information is passed to the body that sets the cookie. Cookies cannot run programs or transfer viruses to your computer. They serve to make the website more user-friendly and effective overall.

(2) This website uses the following types of cookies:

  • Transient cookies (session cookies), which are deleted automatically as soon as you close your browser.
  • Persistent cookies, which are deleted automatically after a set period. You can delete cookies in your browser’s security settings at any time.

(3) You can configure your browser settings as you wish and, for example, refuse to accept third-party cookies or all cookies. Please note that if you disable cookies, you may not be able to use all the features of this website.

(4) We use a consent management tool (cookie banner) on our website. This tool allows you to grant or refuse consent to the setting of non-essential cookies and to the integration of external content (e.g. maps, videos, web analytics, fonts). Consent is logged together with a timestamp for evidence purposes. You can change or withdraw your settings at any time via the consent tool.

(5) The legal basis for the use of technically necessary cookies is Article 6(1)(f) GDPR in conjunction with Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act). For all other cookies and similar technologies, the legal basis is your consent in accordance with Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

9a. Consent management with Cookiebot

(1) We use the Cookiebot service on this website to manage your consent. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.

(2) When you access our website, Cookiebot connects to the provider’s servers. Your truncated IP address, the date and time, browser information, the page accessed and your consent decision are transmitted. Your decision is stored in a cookie in your browser so that we can take it into account on future visits. Consent given is logged for evidence purposes.

(3) The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR (obligation to demonstrate consent) and, in addition, our legitimate interest in legally compliant consent management (Article 6(1)(f) GDPR).

(4) You can change or withdraw your settings at any time via the “Cookie settings” link in the footer.

(5) A data processing agreement in accordance with Article 28 GDPR has been concluded with the provider. Further information: cookiebot.com/en/privacy-policy.

10. Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing your enquiry and in case of follow-up questions. We will not pass on this data without your consent.

This data is processed on the basis of Article 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in handling the enquiries addressed to us effectively (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), if this has been requested.

The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it no longer applies (e.g. once your enquiry has been fully processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

11. Application and tenancy enquiry form

(1) On our website, you can apply for a tenancy or submit a tenancy enquiry via an online form. For this purpose, the personal data requested in the relevant form is processed, in particular:

  • First name and surname
  • Address
  • Date of birth
  • Email address and telephone number
  • Details of your current employment, studies or training
  • Details of your financial situation (e.g. income, employer, guarantor)
  • Preferred property and desired start of tenancy
  • Any further information you provide voluntarily

(2) This data is processed for the purpose of assessing your application or enquiry and for the initiation, performance or termination of a tenancy agreement. The legal basis is Article 6(1)(b) GDPR (steps prior to entering into a contract or performance of a contract).

(3) Insofar as you voluntarily provide us with further details or documents containing personal data (e.g. a copy of your identity card, pay slips, SCHUFA credit report), processing takes place on the basis of your consent in accordance with Article 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future.

(4) Your data will be disclosed exclusively to the relevant departments within our company and, where applicable, to the respective property owner or property management company, insofar as this is necessary for processing your enquiry and concluding the contract. Your data will not be disclosed to uninvolved third parties.

(5) If no tenancy agreement is concluded, your application or enquiry data will be deleted no later than six months after notification of the rejection, unless longer retention is required by law or you have expressly consented to longer retention (e.g. for future lettings).

(6) If a tenancy agreement is concluded, the data collected as part of the application becomes part of the tenant file and is subject to the applicable statutory retention periods.

12. Newsletter

(1) With your consent, you can subscribe to our newsletter, in which we inform you about our current offers. The goods and services advertised are specified in the declaration of consent.

(2) We use the double opt-in procedure for newsletter subscriptions. This means that after you register, we send an email to the address you provided asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your details will be blocked and automatically deleted after one month. We also store the IP addresses you use and the times of registration and confirmation. The purpose of this procedure is to verify your registration and, if necessary, to investigate any misuse of your personal data.

(3) The only mandatory information for receiving the newsletter is your email address. Providing further, separately marked data is voluntary and is used to address you personally. After your confirmation, we store your email address for the purpose of sending you the newsletter. The legal basis is Article 6(1), first sentence, point (a) GDPR.

(4) You can withdraw your consent to receiving the newsletter and unsubscribe at any time, by clicking the link provided in every newsletter email, by emailing webmaster@danke-campus.de or by sending a message to the contact details given in the legal notice.

(5) Please note that we analyse your user behaviour when sending the newsletter. For this purpose, the emails contain so-called web beacons or tracking pixels, which are single-pixel image files stored on our website. For the analysis, we link the data mentioned above and the web beacons to your email address and an individual ID. The data is collected exclusively in pseudonymised form.

(6) We use the following external service provider to send newsletters, with whom a data processing agreement in accordance with Article 28 GDPR has been concluded: CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany. Further information: cleverreach.com

13. Web analytics with Matomo

(1) This website uses the open-source web analytics service Matomo to analyse the use of our website and to improve it regularly. The statistics obtained enable us to improve our offering and make it more interesting for you as a user. The legal basis for the use of Matomo is your consent in accordance with Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, which you can give via our consent tool.

(2) Matomo is operated on Mittwald servers in Germany, so no data is transferred to third parties outside the EU. For the analysis, cookies are stored on your device. The information collected in this way is stored exclusively on our servers or on servers commissioned by us.

(3) We use Matomo with the “Anonymize IP” setting. This truncates the last octets of your IP address before it is stored, which rules out direct personal identification.

(4) You can withdraw your consent at any time via the consent tool. Further information on data protection at Matomo: matomo.org/privacy.

14. Google Maps

(1) On this website, we use Google Maps. This allows us to display interactive maps directly on the website and enables you to use the map function conveniently. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

(2) When you visit the website, Google receives the information that you have accessed the relevant subpage of our website. In addition, the data listed in section 6 “Collection of personal data when you visit our website” is transmitted. This happens regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account.

(3) Google Maps is only integrated after you have given your consent via the consent tool. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Data is also transferred to the USA; the transfer is based on standard contractual clauses in accordance with Article 46(2) GDPR and, where applicable, the EU-US Data Privacy Framework. You can withdraw your consent at any time.

(4) Further information can be found in Google’s privacy policy: policies.google.com/privacy. Opt-out: adssettings.google.com/authenticated.

15. OpenStreetMap

(1) As an alternative or in addition, we use OpenStreetMap on this website, a free project of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. This allows us to display maps directly on the website.

(2) When you access the embedded map, the data listed in section 6 “Collection of personal data when you visit our website” is transmitted to the OpenStreetMap Foundation.

(3) The legal basis is your consent in accordance with Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, which you give via our consent tool.

(4) Further information: wiki.osmfoundation.org/wiki/Privacy_Policy.

16. YouTube videos

(1) We have embedded YouTube videos in our website. They are stored on www.youtube.com and can be played directly from our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

(2) We use YouTube in enhanced privacy mode (“no-cookie mode”). According to the provider, information is only transmitted to the YouTube servers when a video is played. When a video is played, the provider receives the information that you have accessed the relevant subpage of our website. In addition, the data listed in section 6 “Collection of personal data when you visit our website” is transmitted. This happens regardless of whether you have a YouTube account or are logged in.

(3) YouTube videos are only loaded and played after you have given your consent via the consent tool. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Data is also transferred to the USA; the transfer is based on standard contractual clauses in accordance with Article 46(2) GDPR and, where applicable, the EU-US Data Privacy Framework.

(4) Further information: policies.google.com/privacy.

17. Vimeo videos

(1) We have embedded videos from the Vimeo platform in our website. The provider is Vimeo, Inc., 555 West 18th Street, New York, New York 10011, USA.

(2) When you visit one of our pages with an embedded Vimeo video, a connection to Vimeo’s servers is established. Vimeo is informed which of our pages you have visited and also obtains your IP address. If you are logged in to your Vimeo account, you allow Vimeo to assign your browsing behaviour directly to your personal profile. You can prevent this by logging out of your Vimeo account.

(3) Vimeo content is only embedded after you have given your consent via the consent tool. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Data is also transferred to the USA; the transfer is based on standard contractual clauses in accordance with Article 46(2) GDPR and, where applicable, the EU-US Data Privacy Framework.

(4) Further information: vimeo.com/privacy.

18. Fonts (Google Fonts, hosted locally)

(1) This website uses Google Fonts to display fonts consistently. The fonts are loaded exclusively from our own web server. No connection to Google’s servers is established when you access our pages.

(2) Your IP address or other personal data is not transmitted to Google in connection with the display of fonts.

(3) The legal basis for the use of the locally embedded fonts is Article 6(1)(f) GDPR. We have a legitimate interest in the consistent and attractive presentation of our website.

(4) Further information on Google Fonts: developers.google.com/fonts/faq.

19. Rights of the data subject

19.1 Withdrawal of consent

Where the processing of personal data is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can contact us at any time to exercise this right.

19.2 Right to confirmation

You have the right to obtain confirmation from the controller as to whether we process personal data concerning you. You can request this confirmation at any time using the contact details given above.

19.3 Right of access

Where personal data is processed, you can at any time request access to this personal data and to the following information: the purposes of processing, the categories of personal data, the recipients or categories of recipients, the planned storage period, the existence of a right to rectification, erasure, restriction or objection, the existence of a right to lodge a complaint with a supervisory authority, information on the source of the data and the existence of automated decision-making.

19.4 Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.

19.5 Right to erasure (‘right to be forgotten’)

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay where one of the grounds set out in Article 17 GDPR applies (e.g. because the data is no longer necessary for the purposes for which it was collected or because you have withdrawn your consent).

19.6 Right to restriction of processing

You have the right to obtain from us restriction of the processing of your personal data where one of the conditions set out in Article 18 GDPR applies (e.g. if the accuracy of the data is contested or the processing is unlawful).

19.7 Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller, where the processing is based on consent or a contract and is carried out by automated means.

19.8 Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling to the extent that it is related to such direct marketing.

19.9 Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

19.10 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

Competent supervisory authority:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35, 70191 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

19.11 Right to an effective judicial remedy

Without prejudice to any available administrative or non-judicial remedy, you have the right to an effective judicial remedy if you consider that your rights under the GDPR have been infringed.

20. Automated decision-making

We do not use automated decision-making or profiling.

21. Data processors

We use external service providers (data processors), e.g. for hosting, IT maintenance, newsletter distribution and web analytics. Separate data processing agreements in accordance with Article 28 GDPR have been concluded with these providers to ensure the protection of your personal data.

Current data processors:

  • Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany (hosting and Matomo web analytics)
  • Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (Cookiebot, consent management)
  • CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany (newsletter distribution)

22. Note on email communication

When communicating by unencrypted email, we cannot guarantee complete data security. For confidential information, we therefore recommend that you use the post or encrypted means of communication.

Last updated: 11 October 2026