Data Protection (German)

Thank you for your interest in our services and for visiting our website. Protecting your personal data is important to us. As a result, we would like to provide you with information below on the type, scope and purpose of the personal data processed by us. You will also find information on your rights.
Should you have any further questions regarding the handling of your personal data, please do not hesitate to contact our Data Protection Officer.

Name and address of the Data Protection Officer

Should you have any questions concerning the processing of your personal data, you are welcome to contact our Data Protection Officer directly. The Data Protection Officer is also responsible for all requests for information, other requests or complaints.
The company eyeDsec Information Security GmbH provides us with the following external company Data Protection Officer:

Mr. Richard Laqua
eyeDsec Information Security GmbH
Friedrichstrasse 25
95444 Bayreuth
Germany
e-mail: datenschutz@eyeDsec.de
If you have any questions regarding data privacy, please send an e-mail to:
datenschutz@hannover-leasing.de

Getting in touch

If you contact our company, we will collect personal data (e.g. using the contact form, e-mail or telephone). Naturally, the personal data voluntarily transmitted to us in such cases will only be used for the purpose for which you made it available when you contacted us. It goes without saying that you can revoke your declarations of consent at any time with effect for the future. Please contact our Data Protection Officer if you wish to do so.

Definitions

Our data privacy statement is based on the terms set out in Article 4 of the EU General Data Protection Regulation (hereinafter referred to as the “GDPR”). Our data privacy statement is designed to be straightforward, easy to read and easy to understand for everyone. With this in mind, we would like to explain the terms used in advance.
If certain terms nevertheless remain unclear, you are welcome to contact our Data Protection Officer.
What is personal data?
Personal data is defined in Article 4 of the GDPR. It describes personal data as all information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
This includes, for example, your name, your address, your telephone number or your date of birth.

What does the term “processing” mean?

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Who is responsible for processing?

The party responsible (the “controller”) is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
The controller within the meaning of the GDPR, i.e. the party responsible for processing the data on this website, is:

HANNOVER LEASING GmbH & Co. KG
Wolfratshauser Strasse 49
82049 Pullach
Germany
Tel.: +49 (0)89 211 04-0
Fax: +49 (0)89 211 04-210
e-mail: kontakt@hannover-leasing.de

Who is a processor?

A “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

What does “profiling” mean?

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

Use of personal data

Job applications

The controller collects and processes personal data concerning applicants for the purpose of executing the job application procedure. The data may also be processed electronically. This is the case in particular if an applicant sends corresponding application documents electronically, for example by e-mail, to the controller. If the controller concludes an employment contract with an applicant, the data transmitted will be stored for the purpose of processing the employment relationship in accordance with the statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents will be automatically erased six months after the applicant receives the rejection notification, provided that no other legitimate interests of the controller stand in the way of such erasure. “Other legitimate interests” in this sense include, for example, a burden of proof in proceedings under the German General Equal Treatment Act (AGG).

Log files

In general, this website can be used without supplying any personal data. If, however, a data subject wishes to make use of special services offered by our company via our website, it may be necessary to process personal data. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain the consent of the data subject.
Every time you access one of our websites (www.hannover-leasing.de, hannover-leasing.com www.hl-investment.de, www.hl-investment.eu, www.accontis.de, www.kanada-haus.de/) and each time you access a file, corresponding access data is stored in a log file on the server of our hosting service provider. The following data can be recorded:

  • the browser types and versions used,
  • the operating system used by the accessing system,
  • the website from which an accessing system reaches our website (known as the “referrer”),
  • the sub-websites which are accessed via an accessing system on our website,
  • the date and time of access to the website,
  • an Internet protocol (IP) address,
  • the Internet service provider of the accessing system and
  • other similar data and information used to defend against attacks on our information technology Systems.

We do not use this data and information to identify the data subject. This information is required:

  • to display the contents of our website correctly,
  • to optimize the contents of our website, as well as advertising for the website,
  • to ensure the long-term functionality of our information technology systems and the technology behind our website, and
  • to provide law enforcement agencies with the information necessary for law enforcement in the event of a cyber-attack.

This data, which is collected anonymously, is evaluated for statistical and also for data security reasons. Your data is stored by our hosting service provider. It will not be disseminated to third parties for commercial purposes. The anonymous data is stored separately from all personal data provided by a data subject.
If the website allows for the input of personal or business data (e-mail addresses, name, addresses), the user will provide this information on an explicitly voluntary basis. Once again, your data will be treated as confidential and will not be disseminated to third parties.


Cookies and tracking

Our websites use cookies. Cookies are text files that are stored in or by the Internet browser on the user's computer system. If a user accesses a website, a cookie may be stored on his/her operating system. This cookie contains a character string which enables unique identification of the browser when the website is accessed again. We analyze user behavior in order to measure the success and coverage of our website (“web analyses”). “Tracking tools” are often used for this purpose.
A distinction is made between:

  • technically necessary cookies
  • cookies to measure coverage

These different types are described in greater detail in the following chapters.
Your data is passed on to our hosting service provider.

Technically necessary cookies

We use cookies in order to make our website more user-friendly. Some elements of our website require the accessing browser to be identified, even following a change of page.
Technically necessary cookies are not absolutely necessary to display the website. Some website functions, however, such as the contact form, cannot be used properly without these cookies. As a result, there is no option for the user to object; these cookies can be deactivated by changing the settings of the browser being used.
Cookies to measure coverage
Cookies to measure coverage collect information about the way the website is used, e.g. website visits or error messages. These cookies do not store any information that allows the user to be identified. The information collected is only analyzed after having been aggregated, i.e. anonymously.

Use of etracker

Technologies developed by etracker GmbH are used on this website to collect and save data for marketing and optimization purposes. User profiles may be created using this data under a pseudonym. This may involve the use of cookies. Cookies are small text files that are locally stored in the buffer of the website visitor's Internet browser. The cookies enable the site to recognize the Internet browser. The data collected using etracker technology is not used to personally identify visitors to this website without the express permission of the data subject, and is not matched with any personal information pertaining to the person with the pseudonym. You can object to the collection and saving of data at any time with effect for the future.

Advertising via electronic communication

We use your e-mail addresses for purposes extending beyond contract-related use, also for advertising, if you have given your consent or consent is available (Article 6 (1) sentence 1a/1f GDPR). In addition, we inform you about our own and similar products or services by e-mail, regardless of whether you have given your explicit consent. The data will not be used for any other purpose and will not be disseminated to third parties. If you no longer wish to receive advertising on this basis, you can revoke your consent at any time:

  • by sending an e-mail to: kontakt@hannover-leasing.de
  • by sending a fax to: (089) 211 04-210 or
  • or by sending a letter to: HANNOVER LEASING GmbH & Co. KG, Wolfratshauser Strasse 49, 82049 Pullach, Germany

Google Maps

This page uses the Google Maps map service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
To use the functions of Google Maps, your IP address has to be saved. This information is generally transmitted to, and saved on, a Google server in the US. The provider of this site has no influence over this data transmission.
Google Maps is used in the interests of presenting our online offering in an appealing manner, and to make it easy to find the places indicated by us on the website. This represents a legitimate interest within the meaning of Article 6 (1f) GDPR.
You can find more information on the handling of user data in Google's data privacy statement: https://www.google.de/intl/de/policies/privacy/.

Registration and login for the investor and sales partner portal

This section describes how we use your personal data when you visit our websites at https://hl.kdportal.de/ or https://hl.vpportal.de, or make use of services on one of these websites (e.g. registration for the investor portal; newsletter).

1. Collection and processing of personal data when visiting and using our website
1.1. Data that is automatically collected and stored when you visit our website

Every time you visit our website, data which is transmitted by your browser is collected and stored automatically. This data is saved in server log files and includes:

  • Browser type/version
  • Operating system
  • Device type (desktop, tablet, smartphone)
  • Screen resolution
  • Provider
  • URL (source of a link)
  • Time of the server request
  • Country and location of the request
  • Time spent on the page in question

We do not assign this data to specific users, but store it separately from other personal data.

1.2. Data that you actively provide us with

In addition, we process the personal data that you actively submit to us when you register for our investor portal, use the investor portal, contact us (e.g. support) or subscribe to our e-mail newsletter.
Data we collect from you
When you register for our investor portal and use the investor portal as a registered user, we collect and process information concerning you. At the moment, only data relating to notification of a change in details is collected (Datenänderungsformular.pdf)

  • Title
  • Academic degree
  • First name
  • Surname
  • Street House number
  • Address for shipment
  • ZIP code Place of residence
  • ZIP code Town/city
  • Country
  • Personal e-mail address
  • Business e-mail address
  • Cellphone no.
  • Personal telephone no.
  • Business telephone no.
  • Bank
  • IBAN
  • SWIFT BIC
  • Tax authorities in place of residence
  • Personal identification number
  • Tax identification number

The following data is displayed/processed:

  • First name
  • Surname
  • Street
  • Country
  • ZIP code
  • Town/city
  • Personal telephone no. 1
  • Personal fax no.
  • Personal e-mail address
  • Personal cellphone no.
  • Tax number
  • Tax ID
  • Correspondence from and to the investor (but only if declared publicly available)
  • Investment information (a breakdown is not required here, as this is not personal data.)

2. Purposes for which we process your data

We only use the abovementioned data for the following purposes:

  • Website management;
  • Improvement of our website based on usage habits;
  • Use of our investor portal;
  • To inform you about news and special offers regarding our products or services if you have given us your explicit consent regarding the receipt of such information. You can unsubscribe from such information at any time and revoke your consent by sending us an e-mail (investorenbetreuung@hannover-leasing.de);
  • To answer your questions;
  • For communication regarding your investments;
  • To provide you with documents and information about and in connection with your investments;
  • To save your master data and allow you to modify it;
  • To allow you to participate in the online voting process;
  • To allow you to subscribe for new investments online.

3. Legal basis for data processing; duration of storage

The legal basis for collecting and processing the data described above depends on the personal data concerned and the specific context in which we collect it.
The processing of data that is automatically collected when you use our website is based on our legitimate interest in understanding how our website is used so that we can improve our offering at https://hl.kdportal.de/.
The processing of the data that you send us as part of your registration for our investor portal, when you contact us or subscribe to our e-mail newsletter is based on your consent.
Your data will be stored for the duration of the applicable statutory retention period. After this period has expired/as soon as we no longer have any legal basis for processing your data, it will be erased.

4. Dissemination of data to third parties

We do not disseminate your data to other companies outside of the HANNOVER LEASING Group, but only to other companies belonging to the Hannover Leasing Group and affiliated companies. These companies include Hannover Leasing Investment GmbH, Die Hannover Leasing GmbH & Co. KG and ACCONTIS GmbH Finanzanlagen und Beteiligungen. These data recipients only use your data for the purposes specified in section 3.

5. Matomo analysis tool (formerly Piwik)

These websites use Matomo. This is a web analysis service. Matomo allows website usage to be analyzed. For this purpose, the information generated as a result of the use of the website (including your abbreviated IP address) is transmitted to our server and stored for usage analysis purposes. The collection of this data serves to optimize our website. Your IP address is immediately rendered anonymous during this process, meaning that you remain anonymous to us as a user. The information generated about your use of this website is not disseminated to third parties.

Erasure and blocking of data

We only store personal data concerning the data subject for the period necessary to achieve the storage purpose. An extension of the storage period is only necessary if required by applicable laws and provisions.
After the storage period, the personal data is routinely blocked or erased in accordance with the statutory provisions.
No data transmission to third parties
Your data will not be transmitted to third parties unless we are legally obliged to do so. Where external service providers come into contact with your personal data, we have taken legal, technical and organizational measures and carry out regular checks to ensure that they comply with the provisions of the data protection laws.

Rights of the data subject (your rights)

Right to information

Any person affected by the processing of personal data has the right to obtain, at any time and free of charge, information from the controller on the personal data concerning him/her that the controller has stored, as well as a copy of this information. The data subject also has the right to obtain the following information:

  • the purposes of the processing
  • the categories of personal data concerned
  • the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing
  • the right to lodge a complaint with a supervisory authority
  • information to be provided where personal data has not been obtained from the data subject: all available information on the origin of the data
  • the existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

Furthermore, the data subject has a right to information as to whether personal data has been transferred to a third country or to an international organization. If this is the case, the data subject has the right to obtain information on the appropriate safeguards relating to the transfer.
If you would like to make use of this right to information, you can contact our Data Protection Officer at any time.

Right to rectification

Any person affected by the processing of personal data has the right to request the immediate rectification of inaccurate personal data concerning him/her. Furthermore, taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
If you would like to make use of this right to rectification, you can contact our Data Protection Officer at any time.

Right to erasure (‘right to be forgotten’)

Any person affected by the processing of personal data has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:

  • the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
  • the data subject withdraws consent on which the processing is based according to Article 6 (1a) GDPR or Article 9 (2a) GDPR, and where there is no other legal ground for the processing.
  • the data subject objects to the processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21 (2) GDPR.
  • the personal data has been unlawfully processed.
  • the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
  • the personal data was collected in connection with the offer of information society services pursuant to Art. 8 (1) GDPR.

If you would like to make use of this right to erasure, you can contact our Data Protection Officer at any time.

Right to restriction of processing

Any person affected by the processing of personal data has the right to obtain from the controller restriction of processing where one of the following applies:

  • The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
  • The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead.
  • The controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defense of legal claims.
  • The data subject has objected to processing pursuant to Article 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the above conditions is met and a data subject requests the restriction of personal data, he/she can contact our Data Protection Officer at any time.

Right to data portability

Any person affected by the processing of personal data has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format.
In addition, he/she has the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where:

  • the processing is based on consent pursuant to Article 6 (1a) GDPR or Article 9 (2a) GDPR or on a contract pursuant to Article 6 (1b) GDPR; and
  • the processing is carried out by automated means.

That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In exercising his or her right to data portability pursuant to Article 20 (1) GDPR, the data subject shall also have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.
To assert the right to data portability, the data subject can contact our Data Protection Officer at any time.

Right to object

Any person affected by the processing of personal data has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Article 6 (1e) or (1f) GDPR.
If objections are raised, our company shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
If our company processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling insofar as it is connected with such direct marketing.
To assert the right to object, the data subject can contact our Data Protection Officer directly at any time.
Automated individual decision-making, including profiling
Any person affected by the processing of personal data has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her insofar as the decision:

  1. is not necessary for entering into, or performance of, a contract between the data subject and a data controller, or
  2. is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
  3. is based on the data subject's explicit consent.

If the decision

  1. is necessary for entering into, or performance of, a contract between the data subject and a data controller or
  2. is based on the data subject's explicit consent,

our company shall take appropriate measures to safeguard the rights and freedoms, as well as the legitimate interests of the data subject.
If the data subject wishes to assert rights with regard to automated decisions, he/she can contact our Data Protection Officer at any time.

Right to revoke a declaration of consent

Any person affected by the processing of personal data has the right to revoke consent he/she has granted to the processing of personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal.
If the data subject wishes to assert his/her right of revocation, he or she can contact our Data Protection Officer at any time.

Right to lodge a complaint with a supervisory authority

Notwithstanding any other administrative law or judicial legal remedies, you have the right to complain to a regulatory authority, in particular in the Member State where you are resident, your place of work or the place of the alleged breach, if you consider that the processing of your personal data breaches the GDPR. The regulatory authority which has received the complaint will notify the complainant about the position and outcomes of the complaint including the possibility of a judicial legal remedy pursuant to Article 78 GDPR.

Security

We have taken extensive technical and organizational measures to protect your data. Among other things, these measures have taken into account, and continue to take into account, state-of-the-art technology, implementation costs, the type and scope of processing as well as the different probabilities of occurrence and the respective severity of the risk to the rights and freedoms of a natural person.
Our security procedures are reviewed and adapted to reflect technological progress on a regular basis.

© HANNOVER LEASING GmbH & Co. KG | Wolfratshauser Straße 49 | 82049 Pullach | Germany
Phone +49 (0) 89 21 104-0  | Fax +49 (0) 89 21 104-210 | E-Mail: kontakt@hannover-leasing.de