Privacy Policy for Website, Contacting, Direct Marketing, and for Events in Accordance With
Art. 13 and 14 GDPR

Wherever ‘OTTO Immobilien’ is mentioned below, this refers to OTTO Immobilien GmbH, OTTO Immobilien Management GmbH and OTTO Immobilien Bewertung GmbH. eugen GmbH is an independent company within the OTTO Group and is mentioned separately where relevant.

The protection of your personal data is of particular concern to OTTO Immobilien. We process your personal data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (‘GDPR’), the applicable Data Protection Act (“DSG”) and the Telecommunications Act (‘TKG’).

1. Name and Address of the Person Responsible

The person responsible for processing your personal data in accordance with data protection regulations is

OTTO Immobilien 
Riemergasse 8,
1010 Vienna
Tel: + 43 1 512 77 77
E-mail: office@otto.at

Please contact us directly if you have any questions about data processing concerning you.

2. Data Processing Website

2.1. Scope of the processing of personal data when using the website

In the course of your visit to our website, we will automatically collect the following personal data about you:

The date and time a page on our website was accessed;

Data about your end device (Devide ID);

IP address;

Name and version of your web browser;

Session ID.

For information on the cookies we collect when you visit our website, please refer to our cookie statement.

2.2. Legal bases for the processing of personal data

As far as the data of your visit to our website and online services is concerned, we rely on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to justify the processing, which consists of making our website user-friendly and protecting you from attacks.

2.3. Purpose of data processing

We process your data in connection with your visit to our website for the following purposes:

 

• to provide you with our website, including its functions, and to further improve and develop this website;
• to be able to create usage statistics;
• to recognise, prevent and investigate attacks on our website and online services.

2.4 Duration of storage

We will generally store your data relating to your visit to the website for a period of 14 days. Data will only be stored for longer if this is necessary to investigate any attacks on our website and only until the end of any applicable limitation periods, statutory retention periods or any legal disputes.

2.5 Recipients of data

We regularly use IT service providers to operate and manage the website, who may also have access to personal data on our behalf and in accordance with our instructions in order to be able to provide the commissioned IT services. We also transfer your personal data to the following recipients:

to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of a claim, etc.);

to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).

Your data will not be passed on to any other third parties for their own purposes without your consent.
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or in the context of the use of third-party services, this will only take place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. At your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.
Insofar as this involves a transfer to countries without an adequacy decision pursuant to Art. 45 para. 3 GDPR and without suitable guarantees pursuant to Art. 46 GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.

3. Data Processing Contacting

3.1. Scope of the processing of personal data when contacting us

If you contact us by e-mail, telephone, fax, post, via our social media channels or via our contact form, we process the personal data you provide (e-mail, name, telephone, etc.) and the content of your enquiry.
If you contact us via our social media pages on Facebook, Instagram, Tik Tok or LinkedIn, we will receive your personal data from the respective operators of the social media platform and will also transmit your personal data to the respective operators.

3.2. Legal basis for the processing of personal data

In order to be able to answer your enquiry, we rely on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to justify the processing, which consists of answering your question in a satisfactory manner.

3.3. Purpose of data processing

We process your data in connection with your enquiry for the purpose of providing you with a personalised and satisfactory response.

3.4. Duration of storage

We will generally store your data in connection with inquiries and contacts for a period of six months after answering the inquiry in order to be able to respond to any follow-up questions. Data will only be stored for longer if this is necessary to investigate any attacks on our website and only until the end of any applicable limitation periods, statutory retention periods or any legal disputes.

3.5. Recipients of data

To respond to enquiries, we regularly use IT service providers who may also have access to personal data on our behalf and in accordance with our instructions in order to be able to provide the commissioned IT services.
We also transfer your personal data to the following recipients:

to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of a claim, etc.);

to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).

Your data will not be passed on to any other third parties for their own purposes without your consent.
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or in the context of the use of third-party services, this will only take place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. At your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.

Insofar as this involves a transfer to countries without an adequacy decision pursuant to Art. 45 para. 3 GDPR and without suitable guarantees pursuant to Art. 46 GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.

4. Data Processing for Direct Marketing

4.1. Scope of the processing of personal data for direct marketing

If you give us your voluntary consent to contact you for marketing purposes, we will process your email address, name, telephone number, title and title for the purpose of sending you direct marketing materials about properties and related offers, in-depth market reports, events and similar propertyrelated services by e-mail and telephone.
If you receive a download link for documents via our CRM system in this context, we can also see whether and when (date and time) you have downloaded the files.

4.2. Legal basis for the processing of personal data

We process your data in connection with direct marketing only on the basis of your express consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent to advertising contact at any time, without giving reasons for all or individual purposes and with effect for the future (e.g. via a link at the end of each newsletter).

4.3. Purpose of data processing

We process your data in connection with direct marketing for the purpose of providing you with information about property and related offers, in-depth market reports, events and similar services from the property sector by e-mail and telephone.

4.4. Duration of storage

If you have only registered to receive newsletters and direct marketing and are not a customer of ours, we will store your personal data until you cancel your registration and for a maximum of three years.

4.5. Recipients of data

For the use of direct marketing, we regularly use IT service providers and other service providers who support us in the provision of our services and act on our behalf (including providers of marketing tools, marketing agencies, communication service providers and call centres) (processors).
We also transfer your personal data to the following recipients:

to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of a claim, etc.);

to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).

If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or in the context of the use of third-party services, this will only take place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. At your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.

Insofar as this involves a transfer to countries without an adequacy decision pursuant to Art. 45 para. 3 GDPR and without suitable guarantees pursuant to Art. 46 GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.

5. Data Processing Events

5.1. Scope of the processing of personal data at events

Photographs and/or films/videos may be taken by us or on our behalf as part of events. By registering for an event, you acknowledge that photographs and video material in which you are depicted will be stored, used for press coverage and published in various (social) media, publications and on OTTO Immobilien websites (including in blog posts).

5.2. Legal basis for the processing of personal data

We (as the organiser) base the processing of your personal data on our legitimate interest in documentation pursuant to Art. 6 (1) (f) GDPR.

5.3. Purpose of data processing

We process your data for the purposes of documenting the event and for marketing purposes.

5.4. Duration of storage

We store photographs and/or films/videos of events for three years from the date of the event.

5.5. Recipients of data

For the creation of photographs, films/videos, press reports, publications and content for our various (social) media and for the OTTO Immobilien websites (including blog posts), we regularly use (IT) service providers who may also have access to personal data on our behalf and in accordance with our instructions in order to be able to provide the commissioned (IT) services. We also transfer your personal data to the following recipients:

to other external third parties to the extent necessary (e.g. auditors, insurance companies in the event of an insurance claim, legal representatives in the event of a claim, etc.);

to authorities and other public bodies to the extent required by law (e.g. tax authorities, etc.).

Your data will not be passed on to any other third parties for their own purposes without your consent.
If we process your data in a third country outside the European Union (EU) or the European Economic Area (EEA) or in the context of the use of third-party services, this will only take place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. We have implemented suitable and appropriate safeguards to ensure that the transfer of your data to the respective third country complies with data protection regulations. At your request, we will provide you with a copy of these appropriate safeguards if we process or have your data processed in third countries.

Insofar as this involves a transfer to countries without an adequacy decision pursuant to Art. 45 para. 3 GDPR and without suitable guarantees pursuant to Art. 46 GDPR, such as the USA in particular, we would like to point out that there is a risk that your data transferred in this way may be subject to access by authorities in these third countries for control and monitoring purposes and that no effective legal remedies are available against this.

6. Data Security

We take appropriate technical and organisational security measures to protect your personal data against unintentional or unauthorised deletion, modification or against loss, theft and unauthorised inspection, disclosure, reproduction, use, modification or access. In addition, we and our employees are obliged to maintain data secrecy and confidentiality. Likewise, our processors, who must have access to your personal data in order to fulfil their professional duties, will be granted access and will be subject to the same obligations to maintain data secrecy and confidentiality.

7. Your Rights as the Data Subject

7.1. Right to information

You have the right to request information from us about all personal data concerning you that is processed by us. You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

7.2. Right to rectification and right to restriction of processing

You may request the rectification or completion of incorrect or incomplete data. Under certain circumstances, for example if the accuracy of data is disputed until the accuracy has been verified, you may request that the processing of data be restricted so that it may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

7.3. Right to data portability

You may request that we send you – or, where technically feasible, a third party designated by you – a copy of your data in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where

the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR, and

the processing is carried out using automated procedures.

In exercising this right, you also have the right to obtain that the personal data concerning you be transmitted directly by us to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.

7.4. Right to cancellation

You have the right to erasure of data in certain circumstances, for example if it is not processed in accordance with data protection requirements.
If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

7.5. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR.
In this case, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

7.6. Right to revoke the declaration of consent under data protection law

You have the right to revoke any declaration of consent granted under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

7.7. Supervisory authority

Irrespective of any other legal remedies, you have the right to lodge a complaint with the national supervisory authority of your place of residence if unlawful processing of personal data is assumed. In Austria, the data protection authority, Barichgasse 40-42, 1030 Vienna, e-mail dsb@dsb.gv.at, telephone: +43 1 52 152-0 is responsible.

7.8. Assertion of your rights

To enable us to process your request regarding your above-mentioned rights and to ensure that personal data is not disclosed to unauthorised third parties, please formulate the request by clearly identifying yourself and providing a brief description of the scope of the exercise of your data subject rights listed above.

Data Protection Notice for Applications

Wherever ‘OTTO Immobilien’ is mentioned below, this refers to OTTO Immobilien GmbH, OTTO Immobilien Management GmbH and OTTO Immobilien Bewertung GmbH.
eugen GmbH is an independent company within the group and is mentioned separately where relevant.

The personal data provided by me in my application will be processed by OTTO Immobilien or eugen GmbH, both located at Riemergasse 8, 1010 Vienna, for the purpose of evaluating and assigning my application, matching it with open positions, and for recruiting purposes, depending on the specific position I am applying for.

The processing is carried out for the purpose of implementing pre-contractual measures in accordance with Art. 6 (1) (b) GDPR.

My applicant data (name, title, contact details, photo, CV, cover letter, professional experience, desired employment, date of birth, place of birth, country of birth, citizenship, marital status, driving licence, gender, experience and other documents provided voluntarily, such as references, training and further education certificates) will be retained by the respective responsible company for the duration of the employment relationship, if one is established, and stored after the end of my employment for as long as statutory retention obligations exist (generally seven years for all relevant documents within the meaning of § 132 BAO and § 212 UGB) or for as long as legal claims arising from the employment relationship can be asserted against the employer (usually three years).

Personal data required for the issuance of a service certificate in accordance with Section 39 of the Austrian Labour Constitution Act (ArbVG) and Section 1163 of the Austrian Civil Code (ABGB) will be stored for a period of 30 years.

In addition, my personal data will also be stored beyond the aforementioned periods if necessary, as long as legal claims arising from the relationship between me and OTTO Immobilien or eugen GmbH can be asserted or until a specific incident or legal dispute has been finally clarified. This longer storage period is necessary to safeguard legitimate interests in the assertion, clarification and defence of legal claims.

If no employment relationship is established, my data will be deleted no later than seven months after the end of the application process, unless separate consent has been given for longer storage. Until then, it will be stored to defend against any claims under the GlBG (Art. 6(1)(f) GDPR).

In addition, my applicant data will be processed for the planning, implementation and documentation of internal audit measures and forensic analyses to ensure the continuous improvement of the business processes of OTTO Immobilien and eugen GmbH (Art. 6 (1) (f) GDPR).

The personal data collected within the framework of the recruiting tool is processed on behalf of OTTO Immobilien by Sage GmbH, Stella-Klein-Löw-Weg 15, 1020 Vienna, as a processor on the basis of an agreement in accordance with Art. 28 GDPR.

OTTO Immobilien and eugen GmbH take appropriate technical and organisational security measures to protect my personal data from accidental or unauthorised deletion, alteration or loss, theft and unauthorised access, disclosure, reproduction, use, modification or access. In addition, OTTO Immobilien and eugen GmbH and their employees are obliged to maintain data secrecy and confidentiality. Likewise, the processors who need access to my personal data in order to perform their professional duties will be granted access and will be subject to the same obligations of data secrecy and confidentiality.

My rights as a data subject:

Right to information
I have the right to obtain information from OTTO Immobilien and eugen GmbH about all data relating to my person that is processed by OTTO Immobilien and eugen GmbH.

In addition, I have the right to rectification, restriction of processing, data portability, erasure, objection and revocation of any consent given under data protection law.

Right to rectification and right to restriction of processing
I can request the correction or completion of inaccurate or incomplete data. Under certain circumstances, for example if the accuracy of data is disputed, I can request that the accuracy be verified until the accuracy is verified.

Right to data portability
I can request that OTTO Immobilien or eugen GmbH send me – or, if technically feasible, a third party specified by me – a copy of my data in a structured, commonly used and machine-readable format.

I also have the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

– the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR, and
– the processing is carried out using automated means.

In exercising this right, I also have the right to have the personal data concerning me transferred directly from OTTO Immobilien or eugen GmbH to another controller, insofar as this is technically feasible.

This must not adversely affect the freedoms and rights of other persons.

Right to erasure
I have the right to have data erased under certain circumstances, for example if it is not processed in accordance with data protection requirements.

If I have asserted my right to rectification, erasure or restriction of processing against OTTO Immobilien or eugen GmbH, the company responsible in each case is obliged to notify all recipients to whom my personal data has been disclosed of this correction or deletion of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.

Right to object
I have the right to object at any time, on grounds relating to my particular situation, to the processing of personal data concerning me which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR.

In this case, OTTO Immobilien or eugen GmbH will no longer process the personal data concerning me, unless it can demonstrate compelling legitimate grounds for the processing which override my interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to revoke the data protection consent form

I have the right to revoke any data protection consent form I may have given at any time.
The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Supervisory authority
Notwithstanding any other legal remedies, I have the right to lodge a complaint with the national supervisory authority of my place of residence if I believe that my personal data has been processed unlawfully.
In Austria, the data protection authority, Barichgasse 40-42, 1030 Vienna,
email dsb@dsb.gv.at, telephone: +43 1 52 152-0, is responsible.

The entity responsible for processing my personal data in accordance with data protection regulations is – depending on the application – OTTO Immobilien or eugen GmbH.

OTTO Immobilien
Riemergasse 8
1010 Vienna
Tel.: +43 1 512 77 77
Email: office@otto.at

eugen GmbH
Riemergasse 8
1010 Vienna
Email: hallo@eugen.at

or the company to which the application was submitted. In order for a request regarding the above-mentioned rights to be processed and to ensure that personal data is not disclosed to unauthorised third parties, the request must be formulated with clear identification of my person and a brief description of the scope of the exercise of my above-mentioned rights as a data subject.

As of: January 2026