Privacy Policy and Terms of Use IR App

Last updated: April 2021

A. PRIVACY POLICY
Your data is in safe hands with us, Immofinanz AG, Wienerbergstrasse 9, 1100 Vienna (hereinafter "Immofinanz", "we", "us"). We are committed to protecting your data and we take this remit seriously. We therefore observe the applicable legal provisions on the protection, lawful handling and confidentiality of personal data as well as data security, in particular the General Data Protection Regulation ("GDPR"), the Austrian Telecommunications Act ("TKG") and the applicable Data Protection Act ("DSG"). Please take the time to read this data protection declaration and get an idea of why we collect your data and how we process it when you visit our websites www.immofinanz.com, https: //myhive-offices.com, https://www.stop-shop.com, https://vivo-shopping.com, use the app or other applications, software programmes, digital media, storage media ("services").

If you fail to provide certain mandatory information, this may mean that your registration as a user cannot be processed or that certain functions or services on the website cannot be used.

1. What data do we process, for what purpose and on what legal basis?

1.1. Access data and log files

If you use our services, i.e. access the respective server, we process the following data of yours:

• the Internet Protocol ("IP") address used to connect your computer to the Internet;
• computer, device and connection information such as browser type and version, operating system, screen resolution and mobile platform;
• the uniform resource locator ("URL)";
• clickstream data, including the date and time of the content for a service which you viewed or searched for and the URL that referred you to that service.

These data are automatically generated by our servers when you use our services and are required so that we can provide you with the services you desire. We therefore only process server log files in order to be able to provide you with a user-friendly and secure website and the associated services (e.g. to investigate acts of abuse or fraud). Such data processing is therefore necessary to safeguard our legitimate interests (Art 6 Paragraph 1 lit f GDPR).

1.2. Contact data

If you contact us (e.g. by e-mail, online form or by phone), e.g. to request a leasing offer, we will process the personal data you provide, such as your name, telephone number, e-mail address and the content of your request. These data are required to process and answer your request. This processing is therefore carried out to fulfil our (pre-)contractual obligations (Art 6 Paragraph 1 lit b GDPR).

1.3. Registration

Registration is required if you would like to comment on our blog posts. For this, we process your name, e-mail address and notification preference. This processing is necessary in order to provide you with a personal account and to prevent misuse of the comment function. This processing is therefore carried out both to fulfil our (pre-)contractual obligations (Art 6 Paragraph 1 lit b GDPR) and on the basis of our legitimate interests (Art 6 Paragraph 1 lit f GDPR).

1.4. Ordering financial reports

On our website you can order the printed version of our financial reports to be sent by post. For this, we process your name, email address, company and postal address. You can choose whether you only want a financial report or regular delivery. This processing of the data you provide is necessary in order to deliver the report and thus serves to fulfil our (pre-)contractual obligations.

1.5. Newsletter

You have various options to subscribe to our newsletters. We process the personal data provided for this purpose on the basis of your voluntarily given consent (Art 6 Paragraph 1 lit a GDPR):

• If you register for our newsletter or blog via the website, we process your first name and surname and your e-mail address in order to send you newsletters and notifications about new blog posts on IMMOFINANZ products and services by e-mail.

• If you have registered for our newsletter on the occasion of the private investor roadshow and have given us your form of address, name, title, e-mail address and address, we will process these data to send press releases, reports, blog posts and videos by e-mail.

• If you have registered as a journalist for our newsletter, we will process your first name and surname, e-mail address, editorial office, editorial office address and business mobile number to send corporate news, ad hoc messages and invitations to events by e-mail, SMS or mail or for phone contact.

• In the event that you have registered as an investor for our newsletter, we will process your first name and surname, e-mail address, company, position, business address, business mobile number and information about the last meeting with IMMOFINANZ representatives, to send corporate news, ad hoc announcements and invitations to events by e-mail, SMS or mail or for phone contact.

Registration for the above-mentioned newsletters takes place in a so-called double opt-in process. After registering, you will therefore receive an e-mail asking you to confirm your registration. This confirmation is necessary in order to prevent misuse, in particular registration by third parties.

We log registrations in order to be able to verify the registration process in accordance with the legal requirements. For this, we process the time of confirmation and the IP address.

The newsletters contain pixel-sized files which are retrieved from the server when they are opened. During download, technical information such as your browser and operating system are collected, as well as your IP address and the time of the download. This information is used for the technical improvement of the services based on the technical data or the target groups and your reading behaviour based on the access locations (which can be determined with the help of the IP address) or the access times.

Statistical data collection also includes an analysis of whether the newsletters are opened, when they are opened and which links are clicked on. We use these evaluations to identify the reading habits of our users and to be able to improve the content of our newsletters and notifications accordingly. We do not monitor individual users.

You can unsubscribe from our newsletters or other notifications at any time with effect for the future. A link to unsubscribe from notifications can be found at the end of each notification. You can also contact us at any time without giving a reason via a downloadable web form at https://immofinanz.com/en/gdpr or send a letter by post.

2. Who will your data be transferred to?

We transfer your personal data to the following external service providers (processors) who support us in providing our services:

• IT service providers and/or providers of data hosting solutions or similar services;
• other service providers, providers of tools and software solutions who also support us in providing our services and who act on our behalf;
• group companies and companies affiliated with Immofinanz AG within the meaning of Section 189a Z8 of the Austrian Commercial Code (UGB) for internal group purposes.

All of our processors only process your data on our behalf and on the basis of our instructions so that we can make our offer available to you.

In addition, we transmit your personal data to the following recipients (responsible persons) to the extent necessary:

• any third parties involved in the provision of services to you in order to fulfil our contractual obligations (e.g. parcel service providers);
• external third parties to the extent necessary on the basis of our legitimate interests (e.g. auditors and tax consultants, insurance companies in the event of an insurance claim, legal representatives in the event of an accident);
• authorities and other public bodies to the extent required by law (e.g. tax authorities).

3. Data security

We have taken appropriate technical and organisational measures to protect your data from unauthorised, illegal or accidental access, processing, use, manipulation, loss or destruction. Furthermore, we and our employees are obliged to maintain data secrecy.

Despite all of our measures, it cannot be ruled out that information which you provide to us via the Internet will be viewed and used by other people. Please be mindful in particular that unencrypted e-mail messages sent via the Internet are not sufficiently protected against unauthorised access by third parties. We therefore recommend that you send confidential information by mail.

4. Changes to the Privacy Policy

In the event of changes in the legal situation or the duties, services and user benefits, we will update the data protection declaration accordingly. If these changes also affect the consents given by users, changes will only be made with their prior consent.

5. Storage period

We will only store your data for as long as is necessary for the purposes for which we collected your data.

We store data in connection with enquiries for six months in order to be able to respond to any queries. For the purposes of customer service and marketing, your data will be stored until you withdraw your consent or three years after you were last contacted. Data in connection with our business relationship are stored in accordance with corporate and statutory retention obligations under tax law.

Moreover, we also store your personal data beyond the specified retention periods, insofar as legal claims may be asserted derived from the relationship between you and us or until a specific incident or legal dispute has been definitively resolved. This longer storage takes place to safeguard our legitimate interests in the assertion, clarification and defence of legal claims.

6. Rights of Data Subjects

You have the right to information about which of your personal data we process as well as to correction, deletion and restriction of data processing and to data portability, provided that the fulfilment of the contract is not thereby impaired. In addition, you may have a right to object if this results from your particular situation. If you have given us your consent to data processing, you can revoke this consent at any time, free of charge, without giving reasons and with future effect.

You can send us your submission to assert your rights as a data subject, for example via the downloadable form at https://immofinanz.com/en/gdpr or in writing to

Immofinanz AG
For the attention of the Data Protection Coordinator
Wienerbergstrasse 9
1100 Vienna, Austria.

If you believe that the processing of your personal data violates the applicable data protection law or that your data protection rights have been violated in any other way, you have the right to complain to the supervisory authority. In Austria, the data protection authority is responsible for this (Barichgasse 40-42, 1030 Vienna).

As of April 2021