Responsible for collecting and processing your personal data is:

MEAG MUNICH ERGO AssetManagement GmbH
Am Münchner Tor 1
80805 München
Germany

Tel.: 089/2489-0
info@meag.com

and for specific areas (e.g. institutional investors) the:

MEAG MUNICH ERGO Kapitalanlagegesellschaft mbH
Am Münchner Tor 1
80805 München
Telefon: 089/2489-0

Germany

info@meag.com

If you have any questions or suggestions pertaining to data protection, you can contact our Data Protection Officer at the above address at any time, with the reference "Data Protection Officer", or by e-mail at datenschutz@meag.com.

We only process personal data that is required to present the MEAG range of services. Exactly which data we process and how we process them depends mainly on the services you use.

Depending on the use of our offers and the data provided, the processed data includes, for example, communication and contact data, (electronic) correspondence, personal master data (e.g. name, date of birth), contract data, bank/account/credit card data, creditworthiness data, usage or log data.

We collect data either from you/your legal representative (Art. 13 GDPR) or from other sources of information (Art. 14 GDPR), i.e. we receive your data, for example:

• if you wish to rent one of our properties or are already a tenant: from yourself, tax offices, health insurance companies and third parties such as brokerage websites or estate agents;
• in the context of a business relationship, including initiation: from the legal representatives and employees of our business partners and third parties such as brokers or credit rating service providers.

Our staff are obliged to maintain confidentiality and only gain access to your data if they require them for a certain processing purpose. The data may also be forwarded to service providers/third parties for the defined purposes. Service providers are called on in the context of the management and maintenance of IT systems, for instance. We only call on service providers that guarantee us an appropriate degree of data protection, and thus the protection of your data in line with our precautions.

We also forward your personal data to public authorities and institutions such as the German Federal Financial Supervisory Authority "BaFin", the European Banking Authority or law enforcement authorities if we are obliged by law or administrative order to do so.

These data may also be passed on to companies within our company group, e.g. within the scope of corporate communications or the management of the company group.

We only forward your data to service providers from outside the European Economic Area (EEA) if the EU Commission confirms an appropriate level of data protection in the country in question, or if other reasonable data protection measures guarantee the safety of your data there (e.g. binding internal company data protection regulations or standard EU contractual clauses). You can request detailed information on this and on the data protection standards at our service providers from outside the EU using the contact details shown above.

We delete your personal data as soon as we no longer require them for processing. This may be the case, for instance, when a tenancy or business relationship ends. Under certain circumstances, EU directives, laws or other regulations that we are subject to prescribe that data be held for up to ten (10) years. Also, in very rare cases, personal data may be stored for up to thirty (30) years if demands of the parties involved or legal statute demands.

In such cases, we block the data in question from any other processing, and we delete all other data not required.

If we process your personal data, you are a "data subject" in the sense of the GDPR. If you are, you have the following rights with regard to us, in addition to the right to object to the processing of your data:

1. Right to information/notification
   You have the right to demand confirmation from us as to whether we are processing your personal data or not. If we are, you have a right to receive information about these data.
2. Right to rectification of the collected data:
   If data pertaining to you are incorrect or incomplete, you can demand their immediate correction and/or completion.
3. Right to erasure/"Right to be forgotten"
   You can demand the immediate deletion of your personal data if:
   • Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
   • You withdraw your consent or object to the processing of your personal data, and there are no other legal grounds requiring the processing;
   • Your data are being processed unlawfully;
   • Your personal data have to be deleted to fulfil EU directives, laws or other regulations that we are subject to;
   • The data of children were gathered without the consent of the parent or guardian.
4. Right to restriction of processing
   You can demand that the processing of your personal data be restricted:
   • In lieu of their deletion;
   • If you contest the correctness of the data, for a period enabling us to verify their accuracy;
   • If we no longer need the personal data for the purpose for which they were processed, but you require them to assert or defend against legal claims;
   • If you have objected to the processing and it is not yet clear whether our justified interests outweigh your reasons.
5. Data portability
   If data are collected on the basis of a contract/consent, and if they are processed with the aid of automatic procedures, you have the right to receive the personal data that you have provided us with in a commonly used and machine-readable format.
6. Right to revoke you data protection declaration of consent
   You can revoke your consent to the processing of your personal data at any time. The revocation will not apply to processing done prior to your objection.
7. Right to complain
   If you think your rights have been violated, you can submit a complaint to a supervisory authority.

Which data and sources do we use?

MEAG leases out both commercial and residential properties. To this end, we process personal data of main tenants, co-tenants (e.g. spouses) and/or guarantors (if required), and of prospective tenants in the pre-contract stage of negotiations.

These data include in particular the master data (first name, last name, titles), contact data (e.g. private address, private and/or business (mobile) telephone number, e-mail address), (electronic) correspondence and other details (e.g. number of children (self-disclosure), bank connection). In the self-disclosure, special categories of personal data may also fall within this scope (sensitive data pursuant to Art. 9 GDPR), if this is required to broker the property (e.g. required structural prerequisites/modifications). Your date of birth and nationality are also required for the financial sanction examination required by law.

As a rule, your personal data will be gathered and processed in the lead-up to the lease contract being finalised. In certain constellations, your personal data may also be collected from other places if required by law. These include in particular the gathering of information relevant to a tenancy from the presiding labour office, social security authority (housing support), or in some rare cases from your employer, upon agreement. We can also receive data from third parties (e.g. brokerage sites, real estate agents, credit check companies).

For what purpose and on what basis do we process your data?

We process personal data in particular to establish, execute and terminate leases, i.e. to fulfil contracts or during pre-contractual measures. The main legal basis for this is Art. 6 para. 1 lit. b GDPR.

In addition, approvals can be called upon as data protection authorisations pursuant to Art. 6 para. 1 lit. a GDPR. If the processing of the data is based on a consent given, you can revoke the consent at any time with effect for the future.

We also process your data in order to meet in particular our German legal obligations as a lessor, on the basis of Art. 6 para. 1 lit. c GDPR. In some cases, e.g. when establishing creditworthiness, investigating criminal acts or when data are exchanged internally for administrative purposes, your data may be processed by us or third parties (e.g. public authorities) to safeguard justified interests pursuant to Art. 6 para. 1 lit. f GDPR.

In certain cases we are obliged to perform a legitimation check when entering into a lease, to prevent money laundering.

We are also obliged to compare your data with the "terror lists" / "sanction lists" due to the European anti-terror directives 2580/2001 and 881/2002, in order to ensure that no money or other resources are made available for terrorist purposes.

We only process some categories of personal data if you give us your explicit consent or if the processing serves to exercise social security or social protection rights or obligations.

Who receives your data?

Within our company, only the people who need your data to meet the above purposes are given access to the data. We sometimes use external service providers for these purposes.The personal data in each individual case may accordingly be transferred to the following bodies, for example:

• Building authorities, registration offices, tax offices and other authorities
• Construction service providers (e.g. craftsmen, architects)
• Financial service providers
• IT service providers
• Building management service providers
• Courts
• Prospective buyers
• estate agents
• Measurement service providers
• Legal representatives, experts, appraisers
• Tax consultants, auditors and advisors
• Credit agencies

When selling real estate, personal data (in particular written correspondence) is forwarded to the potential buyers. The legal basis for this is MEAG's justified interest pursuant to Art. 6 para. 1 lit. f GDPR.

Processors we use (Art. 28 GDPR) or other recipients may also receive data for these purposes. These are, for example, companies in the categories of IT services, logistics, printing services, marketing services, telecommunications and debt collection.

How long do we store your data?

The collected data are deleted immediately after signing the lease agreement, or when it becomes clear that no lease will result with you. If the lease does come about, we delete your personal data in accordance with the retention periods prescribed by law, which begin at the end of the lease. However, there are data that are subject to a statutory retention obligation and that normally have to be kept for ten (10) years, and in exceptional cases (e.g. in order to be able to provide evidence of how the property was used) for up to thirty (30) years.

Is there an obligation to provide the data?

Within a lease relationship or the initiation of a lease, the personal data are to be provided that are required to found, execute and terminate the lease agreement. Without these data we are not able to decide whether to enter into or execute a lease.

Does MEAG have automatic decision-making?

We do not have automatic decision-making/profiling at this time.

Which data and sources do we use?

Within our business relationships, we process personal data from you as a business partner or employee of a business partner. These data include in particular the master data of the contractual partner (first name, last name, titles), contact data (e.g. business address, business (mobile) telephone number, e-mail addresses), bank details and (electronic) correspondence, the protocol files generated when using the IT systems and where applicable other data necessary for an efficient customer relationship. Your date of birth and nationality are also required for the financial sanction examination required by law.

As a rule, your personal data will be gathered from you directly within the know-your-customer process prescribed by law, and to some extent before the contractual relationship actually begins. In certain constellations, your personal data may also be collected from other places. These can include, for instance, situational requests for tax-relevant information by the inland revenue authority or notifications from estate agents of potential buyers.

We also process personal data when required, which we have permissibly obtained from public sources (e.g. company publications, press, internet) or that are legitimately given to us from other companies of Munich Re Group.

For what purpose and on what basis do we process your data?

We process personal data when buying and selling real estate, for services substantiated in contracts pursuant to Art. 6 para. 1 lit. b GDPR and within the framework of business contacts in the case of similar interests pursuant to Art. 6 para. 1 lit. f GDPR.

We also process personal data if this serves the purpose of customer acquisition. We only electronically send you advertising, invitations to events, information about our products and services or news, for instance, with your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can revoke this consent at any time.

Where necessary, we also process your data on the basis of Art. 6 para. 1 lit. f GDPR, in order to protect our justified interests or those of third parties (e.g. public authorities). This applies in particular within the context of investigating criminal acts or for the purpose of internal communication or other administrative purposes.

We may also process your data to meet our statutory obligations as a commissioning company, in particular within the scope of national law pursuant to Art. 6 para. 1 lit. c GDPR.

On the basis of the European anti-terror directives 2580/2001 and 881/2002 and European Union embargo lists, such as the European directive 208/2014, we are obliged to check your first name, last name, date of birth, address and nationality against these lists, to ensure that no money or other resources are made available for terrorist purposes.

Who receives your data?

Within our company, only the people who need your data to meet the above purposes are given access to the data. To do so, we sometimes call upon external service providers. The personal data in each individual case may accordingly be transferred to the following bodies, for example:

• Building authorities, tax offices and other authorities
• Construction service providers (e.g. craftsmen, architects)
• Financial service providers
• IT service providers
• Facility management service providers
• Courts and tribunals
• Tenants
• Legal representatives, experts, appraisers
• Tax consultants, auditors and advisors
• Credit agencies

Processors we use (Art. 28 GDPR) or other recipients may also receive data for these purposes. These are, for example, companies in the categories of IT services, logistics, printing services, marketing services, telecommunications and debt collection.

How long do we store your data?

We delete personal data not subject to statutory retention periods at the end of our business relationship. If the business relationship does not eventuate, data gathered within the course of initiating the agreement will be deleted six (6) months after the decision is announced.

Is there an obligation to provide the data?

Within a business relationship, the personal data are to be provided that are required to found, execute and terminate agreements. Without these data we are not able to make decisions on initiating or executing a contractual relationship.

Does MEAG have automatic decision-making?

We do not have automatic decision-making/profiling at this time.

Which data and sources do we use?

Within the scope of leasing out real estate, we process personal data from the users of our properties that have been gathered by means of video surveillance. The data are primarily photographic and video images, and may therefore belong to special categories of personal data (sensitive data pursuant to Art. 9 GDPR). We gather these data directly from you if you in an area that is under video surveillance.

 

For what purpose and on what basis do we process your data?

We process your data on the basis of Art. 6 para. 1 lit. f GDPR and/or Art. 4 BDSG, in order to protect our justified interests or those of third parties (e.g. public authorities). Monitoring outdoor areas not accessible to the general public, entrances to commercial buildings, office and residential building complexes, delivery zones and stairwells serves to uphold the right to allow access to property, to protect property and to provide evidence in the event of criminal acts (in particular theft and vandalism). The monitoring of publicly accessible areas such as parking buildings or shopping centres serves to protect the life, health and freedom of the monitored individuals.
 

Who receives your data?

Within our company, only the people who need your data to meet the above purposes are given access to the data. To do so, we sometimes call upon external service providers. The video recordings can also be used to prosecute crimes (e.g. burglary or damage to property) and passed on to third parties.

How long do we store your data?

The picture and video material is deleted automatically after 72 hours. We only store the images longer than that if required to assert legal rights or pursue the prosecution of a criminal act.

 

Is there an obligation to provide the data?

It is unavoidable that you provide this kind of data when using the areas subject to video surveillance.

 

Does MEAG have automatic decision-making?

We do not have automatic decision-making/profiling at this time.

From time to time, changes in our offering may lead to adjustments to this information. Please make sure you have the latest version of our Privacy Information.

Last update: 15 July 2025