Data protection declaration

Data protection declaration

The protection of natural persons with regard to the processing of their personal data is a major concern to the LEG Group, as safeguarding the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data are an essential part of our value system.

The LEG Group comprises all companies listed at the end of this page. All these companies contribute to the LEG Group’s business on a collaborative basis: the rental of housing and all related services, such as the provision of heat and other energy services, multimedia services or the renovation and modernisation of real estate. In this context collaborative means that each task/role is generally carried out in one place at a time as a service for the entire LEG Group. Staff (employees for the purposes of data protection) are employed mainly by companies that predominantly do not operate their own operational business, but rather provide services for the other Group companies as personnel-retaining companies. Accordingly, the companies which are property owners and landlords generally do not employ employees or only to a limited extent.

In addition, the LEG Group performs services in connection with the winding-up of the former Development business as well as new construction activities in relation to development projects; some of the relevant companies are also employers. The staff employed there perform only specific internal services for the respective company; all the others are performed by the companies with staff as business suppliers.

The individual companies jointly determine the purposes and means of the processing in order to perform their tasks and constantly share data information in order to perform the services in a collaborative manner. With regard to data processing only one part of the LEG Group will ever establish contact with the data subjects (tenant data/personal data/other customer or business partner data) and represent the LEG Group. The responsibility for safeguarding the rights of data subjects is thus shared by the entire LEG Group.

Thus, for the purposes of the General Data Protection Regulation, the LEG Group is the joint controller as regards the processing of personal data by the individual companies that form this Group (Article 26 of the EU General Data Protection Regulation (GDPR)). These companies have therefore signed a corresponding agreement.

The central office for the coordination of data protection tasks within the LEG Group is Data Protection Management, a unit of the Legal, Audit and Compliance division, that acts on a Group-wide basis within LEG Management GmbH on behalf of the entire LEG Group (Data Protection Management).

TSP-TechnikServicePlus GmbH does not form any part of the LEG Group. Due to its far-reaching organisational integration in the B&O Group it determines the purposes and means of processing personal data independently and is itself a controller with regard to data protection. Therefore, the Data Protection Management unit of the LEG Group merely coordinates the data protection tasks at TSP-TechnikServicePlus GmbH as a service.

As the “controller” who decides on the purposes and means of personal data processing within the LEG Group, we would like to provide you with the following information regarding the processing of personal data within the LEG Group.

“GDPR” refers to Regulation (EU) 2016/679 (EU General Data Protection Regulation) and “BDSG” to the version of the German Federal Data Protection Act dated 25 May 2018.

Note: the “website data protection statement” containing information on the processing of personal data during use of this website can be found further below.

Information pursuant to the GDPR and the new version of the BDSG as of 25 May 2018

1. Controller and legal representatives

Controller is the LEG Group, Hans-Böckler-Strasse 38, 40476 Düsseldorf, Germany, tel. +49 (0) 211 45 68-0, fax +49 (0) 211 45 68-261, e-mail info[at]­

2. Contact details of the Data Protection Officer

The central point of contact for data protection matters at the LEG Group is Data Protection Management, Hans-Böckler-Strasse 38, 40476 Düsseldorf, Germany, e-mail privacy[at]­

The contact for matters concerning the protection of individual personal data and for the supervisory authority is the Data Protection Officer of the LEG Group, Hans-Böckler-Strasse 38, 40476 Düsseldorf, Germany, e-mail datenschutz[at]­

3. Purposes of and legal bases for the processing, including legitimate interests

We process personal data in line with the regulations of the GDPR and the BDSG on the following legal bases:

3.a) Performance of contracts and pre-contractual activities (Article 6 (1) point (b) GDPR)

The processing is for the purposes of performing and acting as a broker for real estate transactions and rental activities in connection with the performance of our contracts with customers and in order to perform pre-contractual activities that are carried out upon request. The purposes of the data processing are based on the specific requirements of the customer (e.g. renting a flat, moving into another flat, invoicing incidental costs etc.) and may include needs analyses, consulting and similar services. In addition, personal data is processed in order to establish and perform contracts with suppliers and service providers on the basis of Article 6 (1) point (b) GDPR in so far as natural persons are concerned.

3.b) For the purposes of legitimate interests (Article 6 (1) point (f) GDPR)

Within the broader context of the contractual relationships pursuant to no. 3.a) above we also process your personal data in so far as this is necessary for the purposes of our legitimate interests or those of third parties. For example:

  • Providing services and/or information that are intended for you
  • Responding to requests via e-mail or contact forms
  • Operating and managing our websites
  • Providing technical support to users
  • Ensuring network and data security to the extent required and permitted
  • Establishing and performing contracts with legal persons
  • Economic design / optimization of the business processes of the LEG group, e.g. digitization of mail for further in-house registration and processing of incoming correspondence
  • External representation of the company in the (labor) market
  • Carrying out direct marketing or market research, unless you have objected to the use of your data
  • Asserting and defending legal claims in the context of legal disputes
  • Preventing and investigating criminal offences
  • Performing video monitoring to safeguard domiciliary rights and gather evidence of any criminal offences
  • Taking measures to ensure building and facility security
  • Taking measures to safeguard domiciliary rights
  • Optimising your living quality through scientific research

3.c) Based on your consent (Article 6 (1) point (a) GDPR)

Provided you have granted us consent to process personal data for specific purposes (for example, photographs in the context of events), the lawfulness of the processing is given on the basis of your consent. This also applies to declarations of consent you granted us before GDPR applied (25 May 2018).

3.d) Based on legal requirements (Article 6 (1) point (c) GDPR) or in the public interest (Article 6 (1) point (e) GDPR)

As a listed company we are subject to statutory obligations, i.e. statutory requirements (e.g. German Money Laundering Act (GwG), tax laws, German Stock Corporation Act (AktG)) as well as stock exchange regulations (for example). The purposes of processing include checking identity and age and preventing fraud and money laundering.

3.e) In order to protect vital interests (Article 6 (1) point (d) GDPR)

The processing of your personal data is required in order to prevent accidents (safety precautions) and may be necessary in the event of accidents (e.g. communicating your data to the fire service and emergency services).

In addition, the following applies to employees within the meaning of Article 88 GDPR in conjunction with Section 26 BDSG:

3.f) For the purposes of the employment relationship (Section 26 (1) BDSG)

Personal data are processed where it is required for decisions regarding the establishment of an employment relationship or after establishing the employment relationship for the purposes of the performance of the contract of employment or terminating it or in order to exercise or fulfil rights and duties under a law or a collective wage agreement, works or service agreement (collective agreement) that relate to representing the interests of employees.

3.g) Based on your consent to us as employer (Section 26 (2) BDSG)

Provided you have voluntarily granted us consent for processing personal data for specific purposes, the lawfulness of the processing is given on the bases of your consent. This also applies to declarations of consent you granted us before GDPR applied (25 May 2018). (Note: consent is voluntarily if, taking into account the employment relationship and dependency of the employed person as well as the circumstances under which the consent was granted, it can be assumed that the data subject exercised his/her own free will.)

4. Categories of personal data

Our processing of personal data extends to the data obtained from customers or other data subjects in the course of our business relationship. To the extent required we also process personal data that we obtain from publicly accessible sources. For example, debtor records, land registers, trading or association registers, press and the internet are considered to be such sources. Furthermore, we process personal data within the LEG Group as well as personal data legitimately shared by third parties (e.g. an external company).

The following personal data are of particular relevance to us:

  • Personal identification data (e.g. name, title, date of birth, private address, work address, work telephone number, work e-mail address)
  • Order/rental agreement/supply contract data (e.g. agreement type, periods, term of rental, quantities, totals, conditions, electricity, gas and water consumption, move-in date, move-out date, rent, service charges, operating costs)
  • Financial identification data (e.g. account number, sort code, bank name)
  • Data concerning financial situation (e.g. loans, distraints)
  • Employee/employment contract data (e.g. job title, hiring date, start of employment contract, termination of employment contract, probation period, availability, holiday, working hours, employee number, cost centre, company pension)
  • Personal details (e.g. marital status, number of children)
  • Payment data (e.g. wages, salary, tax class, commission, bonuses, extraordinary payments, working hours)
  • Social data (e.g. data for social benefit providers, such as pension insurance number, health insurance number, employers’ liability insurance association)
  • Data for assessing the personality of the data subject in terms of their abilities/achievements/behaviour
  • Image data (films, photographs, video recordings, digital photos)
  • To a minor extent, special categories of personal data, such as denomination (for employees), health, country of origin, physical data (e.g. height, hair colour, eye colour) and biometric identification data (e.g. fingerprints)
  • Audio data (audio tape recordings, telephone recordings)
  • IT usage data (proxy, application, access and entry records, telephone records, connection data for e-mail services)
  • Electronic identification data (e.g. IP address, cookies, electronic signature)
  • Data requiring secrecy (e.g. data subject to professional secrecy, official secrecy, tax secrecy, postal and secrecy of telecommunications)
  • Pseudonymised data

5. Recipients of personal data

Within the LEG Group those departments receive access to your data that need them for performing our contractual and statutory obligations. Service providers and vicarious agents (within the meaning of Section 278 of the German Civil Code (BGB)) engaged by us may receive data for these purposes.

With regard to the sharing of data with recipients outside the LEG Group it should be noted that we share data only where statutory provisions require this, the customer has consented or we are authorised to share the data. Under such circumstances, recipients of the data may be, in particular:

  • Service providers which we use in accordance with contracts for processing on behalf of us pursuant to Article 28 GDPR.
  • Craft contractors or comparable companies to whom we transmit personal data in order to carry out the business relationship with you (depending on the contract)
  • Public bodies and institutions (e.g. social benefit providers, residents’ registration offices, land registries, law-enforcement authorities, courts) where statutory or official obligations apply
  • Other recipients, such as postal services for dispatching post, banks for money transfers, debt collection agencies with transfer of claims, experts, persons bound by with professional secrecy (accountants, lawyers, auditors, notaries)

Further data recipients may be those bodies in respect of whom you have granted us consent to transmit data or to whom we are authorised to transmit personal data on the basis of weighing of interests.

6. Transfers to third countries

The LEG Group does not intend to transfer personal data to bodies in countries outside the European Union (third countries).

7. Retention period

The retention period for personal data at the LEG Group is based on the principles of purpose limitation, data minimisation and storage limitation pursuant to Article 5 GDPR. We process and store personal data as long as is necessary for fulfilling the purposes pursuant to no. 3 above and our contractual and statutory duties. Please note that our contracts are continuing obligations that apply for several years or several months at the least. Statutory retention periods are based, for example, on the German Commercial Code (HGB), Tax Code (AO), Money Laundering Act (GwG), Income Tax Act (EStG), Social Codes (SGB) and Civil Code (BGB).

We will erase the data if they are no longer required to fulfil the purposes of no. 3 above or our contractual or statutory obligations.

8. Rights to revocation, to access, to rectification, to erasure, to object, to data portability, to lodge a complaint

In addition to withdrawing consents and taking into account the given and/or restrictive circumstances described in greater detail in the data protection laws, data subjects can

  • obtain access to the personal data concerning them that is processed by the LEG Group (Article 15 GDPR)
  • request the rectification of inaccurate or outdated personal data concerning them that is processed by the LEG Group (Article 16 GDPR)
  • initiate the erasure of personal data concerning them that is processed by the LEG Group, the processing of which is not legally justified (any longer) (Article 17 GDPR)
  • initiate the restriction of processing of personal data concerning them that is processed by the LEG Group (Article 18 GDPR)
  • object to the processing of personal data concerning them that is processed by the LEG Group (Article 21 GDPR)
  • obtain copies of personal data concerning them that has been provided to the LEG Group (Article 20 GDPR)

You may withdraw consents granted for processing personal data at any time. This also applies to withdrawing declarations of consent granted to us before GDPR applied. The withdrawal applies only for the future; the withdrawal does not affect the lawfulness of processing carried out in the past.

Data subjects can assert these rights in respect of the LEG Group using the contact data provided. Irrespective of this, data subjects can also contact supervisory authorities if they wish to complain. The supervisory authority responsible for the LEG Group is the Officer for Data Privacy and Freedom of Information for the State of North Rhine-Westphalia (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, telephone +49 (0) 211 384240, e-mail poststelle[at]­

9. Provision of personal data

We require personal data to enable us to establish, carry out and terminate business relationships as well as to fulfil contractual agreements with the LEG Group. This also applies to data we are required to obtain by law. It is otherwise not possible for the LEG Group to establish or maintain business relationships or to fulfil contractual agreements. However, this expressly does not apply to information provided voluntarily or to consents. Personal data is generally provided to the LEG Group directly by the data subjects and/or by customers, suppliers or possible recipients. The LEG Group does not process personal data for the purpose of automated decision-making on the basis of profiling.

Website data protection statement

You can visit our site without providing any information about you personally. We store only access data without any link to individuals, such as the shortened IP address, the name of your internet service provider, the page from which you visit our site or the name of the requested file. These data are analysed exclusively for the purpose of improving our offering and cannot be traced back to you personally. Wherever it is possible to enter personal or business data (e.g. e-mail address, names, addresses), you provide this data on an expressly voluntary basis. These data are treated as confidential and are processed only in so far as is necessary for performing the services offered, establishing contact as you requested or providing the services or information you required.

Use of session and long-term cookies

We use cookies on different pages in order to make your visit to our website attractive and to enable specific functions to be used. Most of the cookies we use are erased from your hard drive again at the end of the browser session (session cookies). Other cookies remain on your computer and enable us to recognise your computer again the next time you visit (long-term cookies). Our partner companies are not permitted to collect, process or use personal data using cookies via our website.

Google Analytics

This website uses Google Analytics, a web analytics service offered by Google Inc. (“Google”). Google Analytics uses cookies. Cookies are text files that are stored on your computer and that allow your use of the website to be analysed. The information generated by the cookie about your use of this website is typically transferred to a Google server in the US and stored there. If IP anonymisation is activated on this website, Google first shortens your IP address inside European Union member states or other countries which are contracting parties to the Agreement on the European Economic Area. Your full IP address is transmitted to a Google server in the USA and masked there in exceptional cases only.  Google uses the information transmitted to analyse your use of the website, compile reports on website activities and perform other services relating to website usage and internet usage on behalf of the operator of this website. Google does not combine the IP address transmitted by your browser in connection with Google Analytics with any other data. You can prevent cookies from being stored using the corresponding settings in your browser software; however, please note that this means you may not be able to use all of the functions of this website in full. Furthermore, you can prevent Google from acquiring data generated by the cookie and related to your use of the website (incl. your IP address) and from processing these data by downloading and installing the browser plugin available at the following link: browser plugin.

As an alternative to the browser add-on or in browsers on mobile devices please click this link to modify your cookie settings.

MyFonts counter

We use a web font from In accordance with the license terms, page views are tracked by counting the number of visits to our website for statistical purposes and the information transmitted to MyFonts. MyFonts Counter is a service of MyFonts Inc., 500 Unicorn Park Drive, Woburn, MA 01801, USA. Further information on data protection at MyFonts can be obtained via the following link:

Legal note

We hereby expressly stress that we have no control over the design or content of pages accessed via links on our website. Prior to inserting a link we review these sites to ensure there are no indications that their content causes infringements or breaches the law. However, links are always dynamic references. The operators of the linked websites can subsequently change them, which makes it possible for illegal or infringing content to be incorporated in these sites later without our knowledge.

In this case we expressly dissociate ourselves from such illegal or infringing content from the outset. Upon discovering that a specific internet offering to which we have provided a link could cause liability under civil or criminal law we will immediately remove the reference to this page in so far as this is technically possible and reasonable.

Companies in the LEG Group

  • LEG Immobilien SE, Düsseldorf
  • Erste WohnServicePlus GmbH, Düsseldorf
  • EnergieServicePlus GmbH
  • Rote Rose GmbH & Co. KG, Düsseldorf
  • LEG Holding GmbH
  • LEG Recklinghausen Portfolio 1 GmbH
  • LEG Recklinghausen Portfolio 2 GmbH
  • LEG NRW GmbH
  • Gladbau Betreuungs- und Verw.-Ges. mbH, Mönchengladbach
  • AWM Grundstücksgesellschaft mbH, Mönchengladbach
  • Vitus Service GmbH, Mönchengladbach
  • BRE/ GEWG GmbH, Wuppertal
  • GEWG GmbH, Wuppertal
  • LEG Wohnen GmbH, Düsseldorf
  • LEG Grundstücksverwaltung GmbH, Düsseldorf
  • Düsseldorfer Ton- und Ziegelwerke AG
  • German Property Düsseldorf GmbH
  • LEG Wohnungsbau Rheinland GmbH, Düsseldorf
  • LEG Rheinland Köln GmbH, Düsseldorf
  • Noah Asset 4 GmbH, Düsseldorf
  • LEG Wohnen Bocholt GmbH, Düsseldorf
  • Wohnungsgesellschaft Münsterland mbH, Münster
  • MID – Münsterland Immobilien-Dienstleistungen GmbH, Münster
  • Gem. Wohnungsges. NWD GmbH, Münster
  • GeWo mbH, Castrop-Rauxel
  • GeWo Beteiligungsges. mbH
  • Grundstücksgesellschaft DuHa mbH, Düsseldorf
  • LEG Erste Grundstücksverwaltungs GmbH, Düsseldorf
  • LEG Zweite Grundstücksverwaltungs GmbH, Düsseldorf
  • LEG Dritte Grundstücksverwaltungs GmbH, Düsseldorf
  • LEG Vierte Grundstücksverwaltungs GmbH, Düsseldorf
  • LEG Fünfte Grundstücksverwaltungs GmbH, Düsseldorf
  • Ruhr-Lippe Wohnungsgesellschaft mbH, Dortmund
  • RL I Dienstleistungsgesellschaft mbH, Dortmund
  • Ravensberger Heimstättenges. mbH, Bielefeld
  • RH Beteiligungs. mbH
  • GBS Höxter-Paderborn mbH, Höxter
  • SW Westfalen Invest GmbH, Düsseldorf
  • LEG Achte Grundstücksverwaltungs GmbH, Düsseldorf
  • LEG Neunte Grundstücksverwaltungs GmbH, Düsseldorf
  • LEG Wohnen NRW GmbH, Düsseldorf
  • LEG Wohnen Service GmbH, Düsseldorf
  • LEG Beteiligungsverw. mbH, Düsseldorf
  • Hiltrup Grundbesitzverw. mbH
  • LEG Grundbesitzerwerb 1 GmbH & Co. KG
  • Solis GmbH, Düsseldorf
  • Rheinweg Grundstücksgesellschaft
  • LEG Grundbesitzerwerb 2 GmbH & Co. KG
  • Luna Immobilienbeteiligungs GmbH
  • Rheinweg Zweite Grundstücksgesellschaft
  • LEG Grundbesitzerwerb 3 GmbH & Co. KG
  • LEG Sechste Grundstücksverwaltungs GmbH
  • LEG Siebte Grundstücksverwaltungs GmbH
  • LEG Consult GmbH, Düsseldorf
  • WohnServicePlus GmbH, Düsseldorf
  • LEG Solution GmbH, Düsseldorf
  • LEG Grdst.EW Münsterland GmbH, Düsseldorf
  • Grdst.EW Ennigerl. Süd-Ost GmbH, Düsseldorf
  • LEG Wohnviertel Dyk GmbH
  • LEG S Köln GmbH, Cologne
  • LEG Bauen und Wohnen GmbH
  • LEG Rheinrefugium Köln GmbH
  • LEG Management GmbH, Düsseldorf
  • LCS Consulting und Service GmbH, Düsseldorf
  • Biomasse Heizkraftwerk Siegerland GmbH & Co. KG, Liebenscheid
  • Biomasse-Heizkraftwerk Siegerland Verwaltung GmbH, Düsseldorf