Privacy Policy
Protection of Your Personal Data

1. General Information on Data Processing on this Website

1.1. Data Controller

The data controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

1.2. Data Protection Officer

The data protection officer is:

1.3. Protection of Your Data

We have implemented technical and organizational measures that ensure that the provisions of the GDPR are observed both by us and by external service providers who work for us.

When we work with other companies, such as email and server providers, to provide our services, this only happens after an extensive selection process. In this selection process, each individual service provider is carefully selected for their suitability in connection with technical and organizational capabilities in data protection. This selection process is documented in writing and a contract pursuant to Art. 28 para. 3 GDPR on the processing of personal data on behalf (order processing agreement) is only concluded if it meets the requirements of Art. 28 GDPR.

Your information is stored on specially protected servers. Access to it is only possible for a few specially authorized persons.

Our website is SSL/TLS encrypted, which you can recognize by the "https://" at the beginning of the URL. If personal data is involved in email communication, email transmission from our side is encrypted. We also use the integrated SSL certificate for this purpose.

1.4. Deletion of Personal Data

We only process personal data for as long as is necessary. As soon as the purpose of data processing is fulfilled, blocking and deletion takes place according to the standards of the local deletion concept, unless legal regulations prevent deletion.

2. Data Processing on this Website and Creation of Log Files

2.1. Description and Scope of Data Processing

When you visit our website, our web servers temporarily store each access in a log file. The following personal data is collected and stored until automated deletion:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Amount of data transferred
• Message whether the retrieval was successful
• Identification data of the browser and operating system used
• Website from which the access was made

In addition to this personal data, further personal data may be collected by us and our partners, more on this below.

2.2. Legal Basis for Data Processing

The processing of this data is based on Art. 6 para. 1 sentence 1 lit. f) GDPR. Our legitimate interest is based on making our website accessible to you.

2.3. Purpose of Data Processing

Data processing takes place for the purpose of enabling the use of the website (connection establishment). It serves system security, technical administration of the network infrastructure and optimization of the internet offering. The IP address is only evaluated in the event of attacks on our network infrastructure or the network infrastructure of our internet provider.

2.4. Duration of Data Storage

Personal data is deleted as soon as it is no longer required for the above-mentioned purposes. This is the case when you close the website. Our hosting provider may use the data for statistical surveys. However, the data is anonymized for this purpose. Deletion of the data takes place at our hosting provider as soon as the intended purpose has been fulfilled and no contractual, official or legal retention regulations exist.

2.5. Objection and Removal Option for the Data Subject

The website can only be displayed if the described data is processed. Please lodge an objection to the further processing of the data with our data protection officer or the hosting provider.

2.6. Hosting Provider – Amazon Web Services (AWS)

Our internet offering uses the services of hosting provider AWS. Data processing is carried out by: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, Luxembourg 1855, Luxembourg (a subsidiary of Amazon.com Inc., 410 Terry Avenue North, Seattle WA 98109, USA).

Further information on the service provider's data protection can be found here: https://aws.amazon.com/de/privacy/

2.7. Hosting Provider – Vercel Inc.

As part of hosting, we also use the service of the cloud deployment platform Vercel. Data processing is carried out by: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

For further information on data protection at Vercel: https://vercel.com/legal/privacy-policy

3. Use of Cookies

3.1. Description and Scope of Data Processing

Our website uses cookies. These are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive, assigned to the browser you are using, and through which certain information flows to us or the entity that sets the cookie. Cookies cannot execute programs or transmit viruses to your computer. They are used by us to enable you to log in and to analyze the use of our website in anonymized or pseudonymized form and to present you with interesting offers on this website.

Various data can be transmitted in this way:

• Frequency of website visits
• Which functions of the website you use
• Your language setting

When you visit the website, you will be informed about the use of cookies via a cookie banner and referred to the privacy policy.

3.2. Legal Basis for Data Processing

The legal basis for the processing of data by cookies that do not serve solely the functionality of our website is Art. 6 para. 1 sentence 1 lit. a) GDPR.

The legal basis for data processing for cookies that serve solely the functionality of this website is Art. 6 para. 1 sentence 1 lit. f) GDPR.

3.3. Purpose of Data Processing

Our legitimate interest arises from ensuring smooth connection establishment and comfortable use of our website as well as for reasons of evaluating system security and stability. Data processing also takes place to enable statistical evaluation of website usage.

3.4. Duration of Data Storage

There are two types of cookies. Both are used on this website:

• Transient cookies (see a)
• Persistent cookies (see b)

a) Transient cookies are automatically deleted when you close the browser. These include session cookies in particular. These store a so-called session ID, with which various requests from your browser can be assigned to the common session. This allows your computer to be recognized again when you return to our website. Session cookies are deleted when you log out or close the browser.

b) Persistent cookies are automatically deleted after a predetermined period, which may vary depending on the cookie.

3.5. Objection and Removal Option for the Data Subject

You have the option at any time to withdraw your consent to data processing by cookies that do not serve solely the functionality of the website. We also only set cookies after you have agreed to the setting of cookies when visiting the page. In this way, you can prevent data processing via cookies on our website.

You can also delete cookies in your browser's security settings at any time. We point out that you may not be able to use all functions of this website. The setting of cookies can also be prevented at any time by appropriate settings in your internet browser.

3.6. Meta Pixel on public pages

With your explicit consent, we use Meta Pixel on job detail pages to measure clicks on external application links and optimize our recruiting campaigns on Facebook and Instagram. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data can also be processed in the United States.

When you click, we send the CareerApplyClick event, job ID, job slug without URL parameters, application provider, and language. Meta also receives technical data such as your IP address, browser information, and available browser and advertising identifiers. This event measures a click, not a completed application. We do not send names, email addresses, application documents, form contents, or destination URL parameters to Meta. Automatic event collection and automatic advanced matching are disabled.

The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. We do not load the Pixel without Meta consent. Consent for Google does not activate Meta. We store your choice in your browser for up to 180 days. Meta cookies _fbp and _fbc can remain for up to 90 days. If browser storage is unavailable, your choice applies only to the current page.

You can withdraw consent at any time through “Cookie settings” on job detail pages. Withdrawal stops measurement, discards unsent events, and removes Meta cookies. This setting cannot recall events already sent. Refusing or withdrawing consent does not affect your application. For more information, see Meta’s privacy policy.

4. Contact

4.1. Description and Scope of Data Processing

It is possible to contact us via our website using a contact form from the provider Typeform, by phone or by email. Various data is required for answering the request, which is automatically stored for processing. The following data is collected as a minimum (marked as mandatory field) as part of the contact form:

• Information about your person (tenant, landlord, property manager, viewing interested party or applicant, other)
• Email address
• How can we help you?
• Indication of the address to which the concern relates
• Your concern

You can also voluntarily provide the following information:

• Relevant files

No data is passed on to third parties.

4.2. Legal Basis for Data Processing

The legal basis used here is Art. 6 para. 1 sentence 1 lit. b) GDPR.

4.3. Purpose of Data Processing

We process your data exclusively to process your contact request.

4.4. Duration of Data Storage

Your data will be deleted by us as soon as the purpose of data processing has been fulfilled, mostly immediately after the request has been answered. In rare cases, however, it may happen that we keep your data for a longer period. This can result from legal, official or contractual obligations.

4.5. Objection and Removal Option for the Data Subject

You can contact us at any time and object to further processing of your data. In this case, we unfortunately cannot continue communication with you. All personal data that was processed by us during the contact will be deleted in this case, unless legal obligations to retain your data prevent deletion.

5. Registration on the Website

5.1. Description and Scope of Data Processing

You can register on our website. For this purpose, it is necessary that you enter personal data in the registration mask. The following data is collected as a minimum:

• Email address
• First name
• Last name
• Phone number
• Address of the rental property/properties
• Details about the rental property to determine the rental price (rental period, size, floor, year of construction of the house, renovation/modernization, equipment, furnishing)

The data you provide in the registration mask is used exclusively for processing and is generally not passed on to third parties.

5.2. Legal Basis for Data Processing

If you provide personal data that belongs to the mandatory field input masks, data processing is based on Art. 6 para. 1 sentence 1 lit. b) GDPR. If you also enter personal data in the remaining (optional) input field masks, data processing is based on Art. 6 para. 1 sentence 1 lit. a) GDPR.

5.3. Purpose of Data Processing

We process your data exclusively for the purpose of completing your registration and managing your website account with us.

5.4. Duration of Data Storage

The data is deleted as soon as it is no longer required for the purpose for which it was collected. This is the case when you close your account with us and no legal or official retention periods prevent deletion.

5.5. Objection and Removal Option for the Data Subject

Both during and after registration, you are free to change, correct or delete the personal data provided.

6. Data Processing in the Context of Job Applications

6.1. Description and Scope of Data Processing

It is possible to apply to us via our website using an applicant portal "Join.com". For this purpose, personal data is processed and stored for further processing for the respective application procedure. This includes in particular:

• Email address
• First name
• Last name
• Documents (CV, cover letter)

Your data remains exclusively with us and is not passed on, unless you give us express consent for this purpose.

6.2. Legal Basis for Data Processing

The legal bases for data processing are Art. 88 GDPR and § 26 BDSG.

6.3. Purpose of Data Processing

We process your data exclusively for the purpose of conducting the application procedure.

6.4. Duration of Data Storage

If the application should lead to the establishment of an employment relationship, the personal data will be stored in accordance with legal regulations. If the application is not considered in the selection of a potential candidate, it will be deleted according to the rules of the local deletion concept, taking into account the regulations on the AGG, in particular the existing burden of proof according to § 22 AGG.

This does not apply if legal regulations prevent deletion or you have given your consent for longer storage. In this case, further storage of your personal data takes place on the basis of Art. 6 para. 1 sentence 1 lit. c) or lit. a) GDPR.

6.5. Objection and Removal Option for the Data Subject

You can contact us at any time and object to further processing of your data. All personal data that was processed by us during the application procedure will be deleted in this case, unless mandatory legal regulations prevent deletion.

7. Contract Conclusion on the Website

7.1. Description and Scope of Data Processing

If you commission us to manage your properties, we process your name, address, phone number and email address.

7.2. Legal Basis for Data Processing

The legal basis for the associated data processing is Art. 6 para. 1 sentence 1 lit. b) GDPR, i.e. the processing of your data is necessary for the fulfillment of the service contract.

7.3. Purpose of Data Processing

We process your data to conclude the service contract with you, to process the service contract including invoicing by email or post and payment receipt, to ensure timely performance and to inform you about changes.

7.4. Duration of Data Storage

Your data is only stored for as long as is necessary for the fulfillment of the purpose and as long as we are obliged to retain your data due to legal, contractual or official obligations.

7.5. Objection and Removal Option for the Data Subject

Data processing is mandatory to process your service contract, which is why it cannot be waived. There is therefore no removal option.

8. Your Rights

You have the following rights with regard to your personal data:

8.1. Right to Withdraw Consent (cf. Art. 7 GDPR)

If you have given consent to the processing of your data, you can withdraw it at any time. Such withdrawal affects the permissibility of processing your personal data for the future after you have declared it to us. It can be made (remotely) orally or in writing by post or email to us.

8.2. Right to Information (cf. Art. 15 GDPR)

In the case of a request for information, you must provide sufficient information about your identity and provide proof that it is your information. The information relates to the following information:

• the purposes for which the personal data is processed;
• the categories of personal data that are processed;
• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
• the planned duration of storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage duration;
• the existence of a right to rectification or deletion of the personal data concerning you, a right to restriction of processing by the controller or a right to object to this processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information about the origin of the data if the personal data was not collected from the data subject;
• the existence of automated decision-making including profiling pursuant to Art. 22 para. 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

8.3. Right to Rectification or Deletion (cf. Art. 16, 17 GDPR)

You have the right to rectification and/or completion vis-à-vis us as the controller if the processed personal data concerning you is incorrect or incomplete. The controller must carry out the rectification immediately.

You can also request the deletion of the personal data concerning you if one of the following reasons applies:

• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing was based pursuant to Art. 6 para. 1 sentence 1 lit. a) or Art. 9 para. 2 lit. a) GDPR and there is no other legal basis for the processing.
• You lodge an objection to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you lodge an objection to the processing pursuant to Art. 21 para. 2 GDPR.
• The personal data concerning you has been processed unlawfully.
• The deletion of the personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8 para. 1 GDPR.

9. How to Exercise These Rights

To exercise these rights, please contact our data protection officer:

10. Change Reservation

We reserve the right to change this privacy policy in compliance with legal regulations.

As of December 2023

11. Keystone newsletter

When you subscribe to the Keystone newsletter, we use your email address with your consent to send new articles and editorial updates and invitations to Keystone events. After you submit the form, we send a confirmation email. We add your address to the recipient list only after your explicit confirmation. The encrypted confirmation link is valid for 48 hours. We record the confirmation time, source page, consent text version and evidence of the confirmation link used in Resend.

We use Resend, a service provided by Plus Five Five, Inc., USA, to manage recipients and send the newsletter. Resend processes and stores data in the United States. Standard Contractual Clauses in the Data Processing Addendum protect these transfers. Resend also participates in the EU-US Data Privacy Framework.

You can withdraw your consent at any time through the unsubscribe link in each newsletter or by email to datenschutz@buena.com. You will then receive no further newsletters. We retain your unsubscribe status to respect your decision. Withdrawal does not affect the lawfulness of processing before you withdrew your consent.

This section updated on 9 October 2026