Data protection declaration

Data protection declaration

The protection of natural persons with regard to the processing of their personal data is a major concern to the LEG Group, as safeguarding the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data are an essential part of our value system.

The LEG Group comprises all companies listed at the end of this page. All these companies contribute to the LEG Group’s business on a collaborative basis: the rental of housing and all related services, such as the provision of heat and other energy services, multimedia services or the renovation and modernisation of real estate. In this context collaborative means that each task/role is generally carried out in one place at a time as a service for the entire LEG Group. Staff (employees for the purposes of data protection) are employed mainly by companies that predominantly do not operate their own operational business, but rather provide services for the other Group companies as personnel-retaining companies. Accordingly, the companies which are property owners and landlords generally do not employ employees or only to a limited extent.

In addition, the LEG Group performs services in connection with the winding-up of the former Development business as well as new construction activities in relation to development projects; some of the relevant companies are also employers. The staff employed there perform only specific internal services for the respective company; all the others are performed by the companies with staff as business suppliers.

The individual companies jointly determine the purposes and means of the processing in order to perform their tasks and constantly share data information in order to perform the services in a collaborative manner. With regard to data processing only one part of the LEG Group will ever establish contact with the data subjects (tenant data/personal data/other customer or business partner data) and represent the LEG Group. The responsibility for safeguarding the rights of data subjects is thus shared by the entire LEG Group.

Thus, for the purposes of the General Data Protection Regulation, the LEG Group is the joint controller as regards the processing of personal data by the individual companies that form this Group (Article 26 of the EU General Data Protection Regulation (GDPR)). These companies have therefore signed a corresponding agreement.

The central office for the coordination of data protection tasks within the LEG Group is Data Protection Management, a unit of the Legal, Audit and Compliance division, that acts on a Group-wide basis within LEG Management GmbH on behalf of the entire LEG Group (Data Protection Management).

TSP-TechnikServicePlus GmbH does not form any part of the LEG Group. Due to its far-reaching organisational integration in the B&O Group it determines the purposes and means of processing personal data independently and is itself a controller with regard to data protection. Therefore, the Data Protection Management unit of the LEG Group merely coordinates the data protection tasks at TSP-TechnikServicePlus GmbH as a service.

As the “controller” who decides on the purposes and means of personal data processing within the LEG Group, we would like to provide you with the following information regarding the processing of personal data within the LEG Group.

“GDPR” refers to Regulation (EU) 2016/679 (EU General Data Protection Regulation) and “BDSG” to the version of the German Federal Data Protection Act dated 25 May 2018.

Note: the “website data protection statement” containing information on the processing of personal data during use of this website can be found further below.


Information pursuant to the GDPR and the new version of the BDSG as of 25 May 2018

1. Controller and legal representatives

Controller is the LEG Group, Flughafenstraße 99, 40474 Düsseldorf, Germany, tel. +49 (0) 211 45 68-0, fax +49 (0) 211 45 68-261, e-mail info[at]­leg-wohnen.de.

2. Contact details of the Data Protection Officer

The central point of contact for data protection matters at the LEG Group is Data Protection Management, Flughafenstraße 99, 40474 Düsseldorf, Germany, e-mail privacy[at]­leg-wohnen.de.

The contact for matters concerning the protection of individual personal data and for the supervisory authority is the Data Protection Officer of the LEG Group, Flughafenstraße 99, 40474 Düsseldorf, Germany, e-mail datenschutz[at]­leg-wohnen.de.

3. Purposes of and legal bases for the processing, including legitimate interests

We process personal data in line with the regulations of the GDPR and the BDSG on the following legal bases:

3.a) Performance of contracts and pre-contractual activities (Article 6 (1) point (b) GDPR)

The processing is carried out for the provision and mediation of real estate transactions and rental activities within the framework of the implementation of our contracts with customers and for the implementation of pre-contractual measures that are carried out in response to a request. The purposes of the data processing depend on the specific needs of the customer (e.g. renting a flat, moving to another flat, reading meter readings, billing ancillary costs, installing and processing damage claims, carrying out renovation or modernisation work, testing and installing a wallbox [charging station], etc.) and may include, among other things, needs analyses, advice and the like.

In the case of rental properties that must be heated with district heating (this is communicated when the contract is concluded), we hand over the user data to the district heating supplier.

If you are interested in a rental property, you are welcome to contact us by telephone, via messenger (e.g. Whatsapp), in writing or via the chatbot and the property search on our website. The data protection provisions of the respective provider apply to the use of messenger services.

We also process personal data for the initiation and fulfilment of contracts with suppliers and service providers on the basis of Art. 6(1)(b) EU-DSGVO, insofar as these are natural persons or insofar as the contractual partners use employees in the fulfilment of contracts.

3.b) For the purposes of legitimate interests (Article 6 (1) point (f) GDPR)

Within the broader context of the contractual relationships pursuant to no. 3.a) above we also process your personal data in so far as this is necessary for the purposes of our legitimate interests or those of third parties. For example:

  • Provision of services and/or information intended for you
  • Provision of digital / manual goods vouchers
  • Transfer of user data to the basic service provider after a period of 4 weeks, if the tenant has not fulfilled his/her obligation to register him/herself
  • Answering enquiries by e-mail or contact form
  • Obtaining credit information from a creditworthiness service provider (in particular Mietercheck GmbH) to minimise the risk of non-payment in the tenancy relationship; furthermore, we may use this credit information to make you an offer for electricity (lekker Energie, Stadtwerke Bochum), gas (lekker Energie, Stadtwerke Bochum) or internet (Vodafone) in cooperation with our cooperation partners.
  • Operation and administration of our websites
  • Technical user support
  • for ensuring network and data security within the scope of permissible necessity
  • Initiation and fulfilment of contracts with legal entities
  • Initiation and fulfilment of contracts in the context of the purchase/sale of rental properties
  • Guest management at events for business partners, shareholders, investors, guests of the Executive Board, in particular guest management, event invitations (mail or e-mail), registration of participants and reception and event management (Eventkingdom)
  • Economic design/optimisation of the LEG Group's business processes, e.g. digitalisation of letter post for further internal recording and processing of incoming correspondence, training of automated text and image recognition as well as AI for document classification and data extraction
  • External presentation of the company in the (labour) market
  • Evaluation acquisition (Reputativ GmbH)
  • Direct advertising or market research (name, address and e-mail address) unless you have objected to the use of your data for advertising purposes.
  • Assertion of legal claims and defence in the context of legal disputes
  • Prevention and investigation of criminal offences
  • Video surveillance for the purpose of maintaining house rules, protecting the material and intellectual property of the company, protecting customers, suppliers and employees as well as their property and collecting evidence in the event of possible criminal offences
  • Measures for the security and maintenance of the buildings and facilities
  • Measures to ensure the right of access to the premises
  • Scientific research purposes to optimise your living quality
  • Responding to enquiries from guarantor creditors
  • Current creditworthiness information (Bürgel) of business partners in dashboard overview (traffic light system: notification only if there is a significant change)
  • Evaluation of age groups at building level to expand the range of services offered

3.c) Based on your consent (Article 6 (1) point (a) GDPR)

Provided you have granted us consent to process personal data for specific purposes (for example, photographs in the context of events), the lawfulness of the processing is given on the basis of your consent. This also applies to declarations of consent you granted us before GDPR applied (25 May 2018).

3.d) Based on legal requirements (Article 6 (1) point (c) GDPR) or in the public interest (Article 6 (1) point (e) GDPR)

As a listed company, we are subject to legal obligations, i.e. statutory requirements (e.g. Money Laundering Act, tax laws, Stock Corporation Act, etc.) as well as stock exchange supervisory requirements (e.g.). The purposes of the processing include, among others, identity and age verification, fraud and money laundering prevention.

Pursuant to Section 259 of the German Civil Code (BGB), we are obliged to allow each tenant to inspect the unaltered service charge receipts.

We are legally obliged to provide property data at the flat level, including tenant names, to the respective responsible state statistical office in accordance with federal law for the preparation of a register-based census for the respective years.

3.e) In order to protect vital interests (Article 6 (1) point (d) GDPR)

The processing of your personal data is required in order to prevent accidents (safety precautions) and may be necessary in the event of accidents (e.g. communicating your data to the fire service and emergency services).

In addition, the following applies to employees within the meaning of Article 88 GDPR in conjunction with Section 26 BDSG:

The data protection information for the application process is available here.

3.f) For the purposes of the employment relationship (Section 26 (1) BDSG)

Personal data are processed where it is required for decisions regarding the establishment of an employment relationship or after establishing the employment relationship for the purposes of the performance of the contract of employment or terminating it or in order to exercise or fulfil rights and duties under a law or a collective wage agreement, works or service agreement (collective agreement) that relate to representing the interests of employees.

3.g) Based on your consent to us as employer (Section 26 (2) BDSG)

Provided you have voluntarily granted us consent for processing personal data for specific purposes, the lawfulness of the processing is given on the bases of your consent. This also applies to declarations of consent you granted us before GDPR applied (25 May 2018). (Note: consent is voluntarily if, taking into account the employment relationship and dependency of the employed person as well as the circumstances under which the consent was granted, it can be assumed that the data subject exercised his/her own free will.)

3. h) For the protection of legitimate interests (Art. 6 para. 1 lit. f) EU-DSGVO).

In addition, we process your personal data insofar as this is necessary for the protection of legitimate interests of us or third parties. For example:

  • Measures for employee loyalty such as sending cards or gifts to the private address.

3. i) For the fulfilment of legal obligations (Art. 6 para. 1 lit. c) EU-DGSVO

We also process personal data of our employees for the fulfilment of legal obligations of proof and documentation (e.g. § 257 HGB, § 147 AO, § 41 paragraph 1 ES tG), for the processing of wage tax data according to § 39 paragraph 8 and 9 EStG, for time recording for the keeping of working time accounts according to § 7 d paragraph 1 sentence 1 SGB IV, for the documentation of overtime according to § 16 paragraph 2 a ArbZG. Furthermore, according to the European regulations 2580/2001 and 881/2002, we are legally obliged to check applicant data against the so-called terror lists of the European Union before hiring, so that no money or other financial assets are provided to the persons named in the list.

4. Categories of personal data

Our processing of personal data extends to the data obtained from customers or other data subjects in the course of our business relationship. To the extent required we also process personal data that we obtain from publicly accessible sources. For example, debtor records, land registers, trading or association registers, press and the internet are considered to be such sources. Furthermore, we process personal data within the LEG Group as well as personal data legitimately shared by third parties (e.g. an external company).

The following personal data are of particular relevance to us:

  • Personal identification data (e.g. name, title, date of birth, private address, work address, work telephone number, work e-mail address)
  • Order/rental agreement/supply contract data (e.g. agreement type, periods, term of rental, quantities, totals, conditions, electricity, gas and water consumption, move-in date, move-out date, rent, service charges, operating costs)
  • Financial identification data (e.g. account number, sort code, bank name)
  • Data concerning financial situation (e.g. loans, distraints)
  • Employee/employment contract data (e.g. job title, hiring date, start of employment contract, termination of employment contract, probation period, availability, holiday, working hours, employee number, cost centre, company pension)
  • Personal details (e.g. marital status, number of children)
  • Payment data (e.g. wages, salary, tax class, commission, bonuses, extraordinary payments, working hours)
  • Social data (e.g. data for social benefit providers, such as pension insurance number, health insurance number, employers’ liability insurance association)
  • Data for assessing the personality of the data subject in terms of their abilities/achievements/behaviour
  • Image data (films, photographs, video recordings, digital photos)
  • To a minor extent, special categories of personal data, such as denomination (for employees), health, country of origin, physical data (e.g. height, hair colour, eye colour) and biometric identification data (e.g. fingerprints)
  • Audio data (audio tape recordings, telephone recordings)
  • IT usage data (proxy, application, access and entry records, telephone records, connection data for e-mail services)
  • Electronic identification data (e.g. IP address, cookies, electronic signature)
  • Data requiring secrecy (e.g. data subject to professional secrecy, official secrecy, tax secrecy, postal and secrecy of telecommunications)
  • Pseudonymised data

5. Recipients of personal data

Within the LEG Group those departments receive access to your data that need them for performing our contractual and statutory obligations. Service providers and vicarious agents (within the meaning of Section 278 of the German Civil Code (BGB)) engaged by us may receive data for these purposes.

With regard to the sharing of data with recipients outside the LEG Group it should be noted that we share data only where statutory provisions require this, the customer has consented or we are authorised to share the data. Under such circumstances, recipients of the data may be, in particular:

  • Service providers that we use within the framework of order processing contracts in accordance with Art. 28 EU-DSGVO, e.g. when reading out measured values (water or heat).
  • Craftsmen or comparable companies to whom we transfer personal data in order to carry out the business relationship with you (depending on the contract), e.g. in the context of remedying damage, carrying out maintenance, renovation or modernisation measures, installation and maintenance of smoke alarms.
  • Public authorities and institutions (e.g. social insurance agencies, residents' registration offices, land registry offices, law enforcement agencies, courts, state statistical offices) insofar as legal or official obligations exist.
  • Other recipients, e.g. postal services for mail dispatch, banks for money transfers, collection agencies with debt transfer, appraisers, professional secrecy holders (tax consultants, lawyers, auditors, notaries)

Further data recipients may be those bodies in respect of whom you have granted us consent to transmit data or to whom we are authorised to transmit personal data on the basis of weighing of interests.

6. Transfers to third countries

The LEG Group does not intend to transfer personal data to bodies in countries outside the European Union (third countries).

7. Retention period

The retention period for personal data at the LEG Group is based on the principles of purpose limitation, data minimisation and storage limitation pursuant to Article 5 GDPR. We process and store personal data as long as is necessary for fulfilling the purposes pursuant to no. 3 above and our contractual and statutory duties. Please note that our contracts are continuing obligations that apply for several years or several months at the least. Statutory retention periods are based, for example, on the German Commercial Code (HGB), Tax Code (AO), Money Laundering Act (GwG), Income Tax Act (EStG), Social Codes (SGB) and Civil Code (BGB).

We will erase the data if they are no longer required to fulfil the purposes of no. 3 above or our contractual or statutory obligations.

8. Rights to revocation, to access, to rectification, to erasure, to object, to data portability, to lodge a complaint

In addition to withdrawing consents and taking into account the given and/or restrictive circumstances described in greater detail in the data protection laws, data subjects can

  • obtain access to the personal data concerning them that is processed by the LEG Group (Article 15 GDPR)
  • request the rectification of inaccurate or outdated personal data concerning them that is processed by the LEG Group (Article 16 GDPR)
  • initiate the erasure of personal data concerning them that is processed by the LEG Group, the processing of which is not legally justified (any longer) (Article 17 GDPR)
  • initiate the restriction of processing of personal data concerning them that is processed by the LEG Group (Article 18 GDPR)
  • object to the processing of personal data concerning them that is processed by the LEG Group (Article 21 GDPR)
  • obtain copies of personal data concerning them that has been provided to the LEG Group (Article 20 GDPR)

You may withdraw consents granted for processing personal data at any time. This also applies to withdrawing declarations of consent granted to us before GDPR applied. The withdrawal applies only for the future; the withdrawal does not affect the lawfulness of processing carried out in the past.

Data subjects can assert these rights in respect of the LEG Group using the contact data provided. Irrespective of this, data subjects can also contact supervisory authorities if they wish to complain. The supervisory authority responsible for the LEG Group is the Officer for Data Privacy and Freedom of Information for the State of North Rhine-Westphalia (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, telephone +49 (0) 211 384240, e-mail poststelle[at]­ldi.nrw.de.

9. Provision of personal data

We require personal data to enable us to establish, carry out and terminate business relationships as well as to fulfil contractual agreements with the LEG Group. This also applies to data we are required to obtain by law. It is otherwise not possible for the LEG Group to establish or maintain business relationships or to fulfil contractual agreements. However, this expressly does not apply to information provided voluntarily or to consents. Personal data is generally provided to the LEG Group directly by the data subjects and/or by customers, suppliers or possible recipients. The LEG Group does not process personal data for the purpose of automated decision-making on the basis of profiling.


Website data protection statement

You can visit our site without providing any information about you personally. We store only access data without any link to individuals, such as the shortened IP address, the name of your internet service provider, the page from which you visit our site or the name of the requested file. These data are analysed exclusively for the purpose of improving our offering and cannot be traced back to you personally. Wherever it is possible to enter personal or business data (e.g. e-mail address, names, addresses), you provide this data on an expressly voluntary basis. These data are treated as confidential and are processed only in so far as is necessary for performing the services offered, establishing contact as you requested or providing the services or information you required.

Use of session and long-term cookies

We use cookies on different pages in order to make your visit to our website attractive and to enable specific functions to be used. Most of the cookies we use are erased from your hard drive again at the end of the browser session (session cookies). Other cookies remain on your computer and enable us to recognise your computer again the next time you visit (long-term cookies). Our partner companies are not permitted to collect, process or use personal data using cookies via our website.

Google Analytics

This website uses Google Analytics, a web analytics service offered by Google Inc. (“Google”). Google Analytics uses cookies. Cookies are text files that are stored on your computer and that allow your use of the website to be analysed. The information generated by the cookie about your use of this website is typically transferred to a Google server in the US and stored there. If IP anonymisation is activated on this website, Google first shortens your IP address inside European Union member states or other countries which are contracting parties to the Agreement on the European Economic Area. Your full IP address is transmitted to a Google server in the USA and masked there in exceptional cases only.  Google uses the information transmitted to analyse your use of the website, compile reports on website activities and perform other services relating to website usage and internet usage on behalf of the operator of this website. Google does not combine the IP address transmitted by your browser in connection with Google Analytics with any other data. You can prevent cookies from being stored using the corresponding settings in your browser software; however, please note that this means you may not be able to use all of the functions of this website in full. Furthermore, you can prevent Google from acquiring data generated by the cookie and related to your use of the website (incl. your IP address) and from processing these data by downloading and installing the browser plugin available at the following link: browser plugin.


As an alternative to the browser add-on or in browsers on mobile devices please click this link to modify your cookie settings.

MyFonts counter

We use a web font from myfonts.com. In accordance with the license terms, page views are tracked by counting the number of visits to our website for statistical purposes and the information transmitted to MyFonts. MyFonts Counter is a service of MyFonts Inc., 500 Unicorn Park Drive, Woburn, MA 01801, USA. Further information on data protection at MyFonts can be obtained via the following link: https://www.myfonts.com/info/terms-and-conditions.


Legal note

We hereby expressly stress that we have no control over the design or content of pages accessed via links on our website. Prior to inserting a link we review these sites to ensure there are no indications that their content causes infringements or breaches the law. However, links are always dynamic references. The operators of the linked websites can subsequently change them, which makes it possible for illegal or infringing content to be incorporated in these sites later without our knowledge.

In this case we expressly dissociate ourselves from such illegal or infringing content from the outset. Upon discovering that a specific internet offering to which we have provided a link could cause liability under civil or criminal law we will immediately remove the reference to this page in so far as this is technically possible and reasonable.


Companies in the LEG Group

  • AFP II Germany GmbH
  • AWM Grundstücksgesellschaft mbH
  • Beckumer Wohnungsgesellschaft mbH
  • Bielefelder Gemeinnützige Wohnungsgesellschaft mbH
  • Biomasse Heizkraftwerk Siegerland GmbH & Co. KG
  • Biomasse-Heizkraftwerk Siegerland Verwaltungs GmbH
  • BRE/GEWG GmbH
  • CALOR CARRÉ GmbH
  • CeRo Wohnen 2 GmbH
  • CeRo Wohnen GmbH
  • Düsseldorfer Ton- und Ziegelwerke GmbH
  • EnergieServicePlus GmbH
  • Entwicklungsgesellschaft Rhein-Pfalz GmbH & Co. KG
  • Entwicklungsgesellschaft Rhein-Pfalz Verwaltungs GmbH
  • Erste WohnServicePlus
  • Gemeinnützige Bau- und Siedlungsgesellschaft Höxter-Paderborn mbH
  • Gemeinnützige Eisenbahn-Wohnungsbau-Gesellschaft mbH
  • German Property Düsseldorf GmbH
  • GeWo Beteiligungsgesellschaft mbH
  • GeWo Gesellschaft für Wohnungs- und Städtebau mbH
  • Gladbau Baubetreuungs- und Verwaltungs-Gesellschaft mbH
  • Grundstücksentwicklungsgesellsch. Ennigerloh Süd-Ost mbH
  • Grundstücksgesellschaft DuHa mbH
  • Grundstücksgesellschaft Sendenhorst mbH
  • GSA Grundstücksfonds Sachsen-Anhalt GmbH
  • GSB Gesellsch. zur Sicherung von Bergmannswohnungen mbH
  • GWN Gemeinnützige Wohnungsgesellschaft Nordwestdeutchland
  • Hiltrup Grundbesitzverwertungsgesellschaft mbH
  • HKA Grundstücksverwaltungsgesellschaft mbH & Co. KG
  • HKA Verwaltungsgesellschaft mbH
  • KHW Kommunale Haus und Wohnen GmbH
  • LCS Consulting und Service GmbH
  • LEG Achte Grundstücksverwaltungs GmbH
  • LEG Bauen und Wohnen GmbH
  • LEG Beteiligungsverwaltungsgesellschaft mbH
  • LEG Consult GmbH
  • LEG Dritte Grundstücksverwaltungs GmbH
  • LEG Erste Grundstücksverwaltungs GmbH
  • LEG Erste Wohnimmobilien Bremen GmbH
  • LEG Fünfte Grundstücksverwaltungs GmbH
  • LEG Grundstücksverwaltung GmbH
  • LEG Holding GmbH
  • LEG Immobilien SE
  • LEG LWS GmbH
  • LEG Management GmbH
  • LEG Neunte Grundstücksverwaltungs GmbH
  • LEG Niedersachsen GmbH
  • LEG Nord FM GmbH
  • LEG Nord Service GmbH
  • LEG NRW GmbH
  • LEG Objekt Krefeld-Bockum Verwaltung GmbH
  • LEG Recklinghausen 1 GmbH
  • LEG Recklinghausen 2 GmbH
  • LEG Rhein Neckar GmbH
  • LEG Rheinland Köln GmbH
  • LEG Rheinrefugium Köln GmbH
  • LEG Sechste Grundstücksverwaltungs GmbH
  • LEG Siebte Grundstücksverwaltungs GmbH
  • LEG Solution GmbH
  • LEG Standort- und Projektentwicklung Köln GmbH
  • LEG Vierte Grundstücksverwaltungs GmbH
  • LEG Wohnen Bocholt GmbH
  • LEG Wohnen GmbH
  • LEG Wohnen NRW GmbH
  • LEG Wohnimmobilien Oldenburg GmbH
  • LEG Wohnungsbau Rheinland GmbH
  • LEG Zweite Grundstücksverwaltungs GmbH
  • LEG Zweite Wohnimmobilien Bremen GmbH
  • LEG Wohnviertel Dyk GmbH
  • LWS Plus GmbH
  • MID - Münsterland Immobilien-Dienstleistungen GmbH
  • Noah Asset 4 GmbH
  • Ökoconstrukt Gesellschaft für energetische Sanierung mbH
  • Ravensberger Heimstätten Beteiligungsgesellschaft mbH
  • Ravensberger Heimstättengesellschaft mbH
  • RELDA 38. Wohnen GmbH
  • RELDA 45. Wohnen GmbH
  • Resident Baltic GmbH
  • Rheinweg Grundstücksgesellschaft mbH
  • Rheinweg Zweite Grundstücksgesellschaft mbH
  • Rote Rose GmbH & Co. KG
  • Ruhr-Lippe Immobilien Dienstleistungsgesellschaft mbH
  • Ruhr-Lippe Wohnungsgesellschaft mbH
  • Solis GmbH
  • Stadtkrone Ost Entwicklungsgesellschaft mbH & Co. KG
  • SW Westfalen Invest GmbH
  • TSP - TechnikServicePlus GmbH
  • Vitus Service GmbH
  • Weisse Rose GmbH
  • Westgrund Immobilien GmbH
  • Westgrund Niedersachsen Nord GmbH
  • Westgrund Niedersachsen Süd GmbH
  • Westgrund VIII. GmbH
  • Westgrund Wolfsburg GmbH
  • Wohngelegenheit Mitte GmbH
  • Wohngelegenheit Nord GmbH
  • Wohngelegenheit Süd GmbH
  • WohnServicePlus GmbH
  • Wohnungsbaugesellschaft JADE mbH
  • Wohnungsgesellschaft Münsterland mbH
  • Zweite REO-Real Estate Opportunities GmbH