The operator of deutschegenossenschaft.de (nJoyHomes eG) is always careful to implement all data protection regulations. The operator therefore uses technical and organizational measures to ensure the greatest possible data security.

This privacy policy applies exclusively to the website of the operator “njoyhomes.de” (hereinafter referred to as “Portal”).

The portal may contain links to third-party websites. It is expressly pointed out that this data protection declaration does not extend to third-party websites. The data protection provisions formulated there apply to the third-party websites.

Below you will find information about which data is collected during your visit to this portal or during your registration and in what form it is used.

1 Handling of personal data

In order to provide the operator’s services, it is necessary to use personal data.

a) landlord

If you, as a landlord, want to use the operator's services, you must choose a type of entry on the portal and then register. When it comes to entry types, you can choose between the free standard entry and the paid entry types (premium entry, TOP placement, TOP Plus entry and TOP banner).

Your personal data will be used to process the contract concluded with you.

So that you can access your customer account ("landlord login") at any time, the operator stores and uses the user name and password you have chosen in encrypted form.

The processing of the data collected is based on Article 6 paragraph 1 letter b of the General Data Protection Regulation (hereinafter GDPR).

Your "general contact details" will be displayed to those looking for accommodation (hereinafter referred to as "users") on the portal and will enable them to contact you. In order to establish contact between you and the users, the operator requires the following data:

• Name of the accommodation

• Title and name of the contact person

• Address

• At least one telephone number (landline or mobile number)*

• E-mail address*

* The mobile number and email address are only displayed in the paid entry types.

Optionally, you can enter additional data for the paid entry types, which will also be displayed:

• Another phone number

• Another mobile number

• Fax number

• Another email address

• Address of a website/homepage

If you decide to make a paid entry, the operator will also save your billing address and your desired payment method for its accounting purposes. If you choose the "SEPA direct debit" payment method, the operator will also save your bank account details. In addition, the operator will save data that enables it to contact you, i.e.:

• Name of the accommodation

• Title and name of the contact person

• Address

• At least one telephone number (landline or mobile number)

• E-mail address

The operator also uses your telephone number to send you information about products and services related to the portal. If you no longer wish to receive product recommendations or advertising messages from the operator, you can object at any time. Please send your objection to the contact details listed at the beginning of this declaration; e.g. via email to: info@njoyhomes.de

b) User

If you as a user contact the operator of the portal, this will save:

• The name you entered

• Your email address,

• Your telephone number, if you have provided it,

• Your mobile phone number, if you have provided it,

• Your company name, if you have provided it,

• And the content of your message.

This data will only be used to answer your questions.

The processing of the data collected is based on Article 6 (1) (b) GDPR.

If you use the booking request function, the operator will transmit the data entered there to the landlord you have selected:

• Your title and name,

• Your email address,

• Your desired booking period (arrival and departure dates),

• The desired number of people,

• The room type, if you have specified it,

• Your telephone number, if you have provided it,

• Your mobile phone number, if you have provided it,

• Your company name, if you have provided it,

• And the content of your message, if you have written a message.

rights of those affected

a) Right to information

You can request the following information from the operator:

• The purposes for which the personal data are processed;

• The categories of personal data being processed;

• The recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;

• The planned duration for which the personal data concerning you will be stored or, if specific information is not possible, the criteria used to determine that period;

• The existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the operator or a right to object to such processing;

• The existence of a right to lodge a complaint with a supervisory authority;

• All available information about their origin, if the personal data are not collected from the data subject;

• The existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you will be transferred to a third country or to an international organization. In this context, you can request to be informed of the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transfer.

b) Right to restriction of processing

You can request the restriction of the processing of personal data concerning you under the following conditions:

• If you contest the accuracy of the personal data concerning you for a period enabling the operator to verify the accuracy of the personal data;

• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of the use of the personal data instead;

• The operator no longer needs the personal data for the purposes of processing, but you require them to assert, exercise or defend legal claims, or

• If you have objected to the processing pursuant to Art. 21 Para. 1 GDPR and it has not yet been determined whether the legitimate reasons of the operator outweigh your reasons.

If the processing of personal data concerning you has been restricted, these data may – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above-mentioned requirements, you will be informed by the operator before the restriction is lifted.

If your data is incorrect or no longer up to date, you can change it at any time via the internal landlord login area. Since your entry is address-related, you cannot subsequently change the address of your accommodation manually. If you would like to make a subsequent change or correction due to accidental incorrect entries, you can contact the operator at any time using the contact details provided above.

You can also delete individual data in the internal landlord login area. Please note that at least the following data is required to use the portal:

• Name of the accommodation

• Title and name of the contact person

• Address

• At least one telephone number (landline or mobile number)

• E-mail address

• Billing address, desired payment method and account details for SEPA direct debit (required only for fee-based entry types)

If you wish, the operator will make the relevant changes or deletions for you at any time free of charge. If you wish to have your entry completely deleted, the operator can also do this free of charge.

c) Revocation

If you have given your consent for data processing, you can revoke this consent at any time by informing the operator in accordance with Art. 7 Paragraph 3 GDPR. The operator may then no longer continue the data processing based on this consent in the future.

MöIf you wish to exercise your right of objection, simply send an email to: info@njoy-homes.com.

d) Right to erasure

You can request that the operator delete the personal data concerning you immediately and the operator is obliged to delete this data immediately if one of the following reasons applies:

• The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.

• You withdraw your consent on which the processing is based according to Art. 6 Para. 1 lit. a or Art. 9 Para. 2 lit. a GDPR, and there is no other legal basis for the processing.

• You object to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate reasons for the processing, or you object to the processing pursuant to Art. 21 Para. 2 GDPR.

• The personal data concerning you have been processed unlawfully.

• The erasure of personal data concerning you is necessary to fulfill a legal obligation under Union or Member State law to which the operator is subject.

• The personal data concerning you were collected in relation to information society services offered in accordance with Art. 8 (1) GDPR.

e) Information to third parties

If the operator has made the personal data concerning you public and is obliged to delete it pursuant to Art. 17 (1) GDPR, the operator shall take appropriate measures, including technical ones, taking into account the available technology and the implementation costs, to inform data controllers which process the personal data that you, as the data subject, have requested that they delete all links to these personal data or copies or replications of these personal data.

f) Exceptions

The right to erasure does not exist if the processing is necessary

• to exercise the right to freedom of expression and information;

• to fulfill a legal obligation which requires processing by Union or Member State law to which the operator is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the operator;

• for reasons of public interest in the area of public health pursuant to Art. 9 (2)(h) and (i) and Art. 9 (3) GDPR;

• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in section a) is likely to make the achievement of the objectives of this processing impossible or seriously compromises it, or

• to assert, exercise or defend legal claims.

g) Right to information

If you have asserted your right to rectification, erasure or restriction of processing vis-à-vis the operator, the operator is obliged to inform all recipients to whom the personal data concerning you were disclosed of said rectification, erasure or restriction of processing, unless doing so should prove impossible or involve disproportionate expenditure.

You have the right to be informed by the operator about these recipients.

h) Right to data portability

You have the right to receive the personal data concerning you that you have made available to the operator in a structured, common and machine-readable format. In addition, you have the right to transmit this data to another controller without hindrance from the operator to whom the personal data was made available, provided that

• the processing is based on consent in accordance with Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or on a contract in accordance with Art. 6 Para. 1 lit. b GDPR and

• the processing is carried out using automated procedures.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This must not affect the freedoms and rights of other persons.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

i) Right of objection

You have the right to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (e) or (f) GDPR, for reasons related to your particular situation; this also applies to profiling based on these provisions.

The operator will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

If you would like to exercise your right of objection, simply send an email to: info@njoy-homes.com.

3 Transfer of data

If you as a user contact a landlord via the booking request function, the operator will transmit all data you entered there to the respective landlord.

In other cases, your data will only be passed on to third parties with your express prior consent. The only exception to this is in the case of an express official or court order, insofar as the operator is legally obliged to provide information.

Under no circumstances will your data be sold or rented by the operator. Please note, however, that by integrating third-party content into the portal, your IP address may be transmitted directly to the third parties concerned.

4 Duration of data storage

The personal data of the data subject will be deleted or blocked as soon as the purpose for which they were stored no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the operator is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or fulfillment of a contract.

5 Right to lodge a complaint with a supervisory authority

Those affected have the right to lodge a complaint with a supervisory authority at any time; e.g. with the state data protection officer responsible for us.

6 cookies

a) Description and scope of data processing

The operator's portal uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user visits a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is visited again.

The operator uses cookies to make its portal more user-friendly. Some elements of the portal require that the browser accessing the portal can be identified even after a page change.

The following data is stored and transmitted in the cookies:

• Log-in information

• Language settings

The operator also uses cookies on the portal to enable analysis of users’ surfing behavior.

In this way, the following data can be transmitted:

• Search terms entered

• Frequency of page views

• Use of website functions

The user data collected on the portal is pseudonymized using technical precautions. It is therefore no longer possible to assign the data to the user who accessed it. The data is not stored together with other personal data of the user.

When accessing the portal, users are informed about the use of cookies for analysis purposes by an information banner and are referred to this privacy statement. In this context, there is also an indication of how the storage of cookies can be prevented in the browser settings.

b) Legal basis for data processing

The legal basis for the processing of personal data using cookies is Art. 6 (1) (f) GDPR.

c) Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of the portal for users. Some functions of the portal cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after changing pages.

We need cookies for the following applications:

• Remembering search terms

• Language settings

The user data collected through technically necessary cookies is not used to create user profiles.

The analysis cookies are used to improve the quality of the portal and its content. The analysis cookies enable the operator to learn how the portal is used and thus continuously optimize its offering.

For these purposes, the legitimate interest in processing personal data also lies in accordance with Art. 6 (1) (f) GDPR.

d) Duration of storage, possibility of objection and removal/Cookie settings

Cookies are stored on the user's computer and transmitted from there to the operator's portal. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by simply changing the settings in your Internet browser. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for the operator's portal, it may no longer be possible to fully use all of the portal's functions.

We can use essential cookies required for the operation of the portal without your consent, but we will only use other cookies with your consent (e.g. certain analysis and tracking services). You can find information about this when you access the portal or under Cookie Settings in the footer navigation. Here you can also revoke your consent to non-essential cookies.

7 Google Analytics

The operator uses Google Analytics, a web analysis service provided by Google LLC ("Google"), on the basis of its legitimate interests (i.e. interest in the analysis, optimization and economic operation of the portal within the meaning of Art. 6 Para. 1 lit. f. GDPR). Google uses cookies. The information generated by the cookie about the use of the online service by users is usually transferred to a Google server in the USA and stored there.

Google will use this information on behalf of the operator to evaluate the use of the portal by users, to compile reports on the activities within this portal and to provide the operator with other services related to the use of this portal and the Internet. Pseudonymous user profiles of the users can be created from the processed data.

a) IP anonymization

The operator has activated the IP anonymization function on this portal. This means that your IP address will be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this portal, Google will use this information to evaluate your use of the portal, to compile reports on website activity and to provide the operator with other services relating to portal activity and Internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

b) Browser Plugin

You can prevent cookies from being saved by setting your browser software accordingly; however, the operator would like to point out that in this case you may not be able to use all functions of this portal to their full extent. In addition, you can prevent Google from collecting the data generated by the cookie and relating to your use of the portal (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link:

https://tools.google.com/dlpage/gaoptout?hl=de

c) Objection to data collection

You can prevent Google Analytics from collecting your data by simply selecting "Essential cookies" and deselecting "Statistical cookies" when you access the portal or under cookie settings in the footer navigation.

For more information on how Google Analytics handles user data, please see Google’s privacy policy:

https://support.google.com/analytics/answer/6004245?hl=de

d) Demographic characteristics in Google Analytics

The operator uses the “demographic characteristics” function of Google Analytics. This enables reports to be created that contain information about the age, gender and interests of site visitors. This data comes from interest-based advertising from Google as well as visitor data from third parties. This data cannot be assigned to a specific person. You can deactivate this function at any time via the ad settings in your Google account or generally prohibit the collection of your data by Google Analytics as described in the “Objection to data collection” section.

e) Contract data processing

The operator has concluded a contract for order data processing with Google and fully implements the strict requirements of the German data protection authorities when using Google Analytics.

8 Google AdWords and Conversion Measurement

The operator uses the services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on the basis of its legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offering within the meaning of Art. 6 Para. 1 lit. f. GDPR).

The operator uses the online marketing process Google "AdWords" to place ads in the Google advertising network (e.g. in search results, in videos, on websites, etc.) so that they are shown to users who are likely to be interested in the ads. This allows the operator to display ads for and within its online offering in a more targeted manner in order to only present users with ads that potentially match their interests. If, for example, a user is shown ads for products that they were interested in on other online offerings, this is referred to as "remarketing". For these purposes, when the operator's portal and other websites on which the Google advertising network is active are accessed, Google immediately executes a code from Google and so-called (re)marketing tags (invisible graphics or code, also known as "web beacons") are integrated into the website. With their help, an individual cookie, i.e. a small file, is stored on the user's device (comparable technologies can also be used instead of cookies). This file records which websites the user has visited, which content he is interested in and which offers the user has clicked on, as well as technical information on the browser and operating system, referring websites, time of visit and other information on the use of the online offer.

The operator also receives an individual "conversion cookie". The information obtained using the cookie is used by Google to create conversion statistics for the operator. However, the operator only learns the anonymous total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, the operator does not receive any information that can be used to personally identify users.

The user data is processed pseudonymously within the Google advertising network. This means that Google does not store and process the name or email address of the user, for example, but processes the relevant data in a cookie-related manner within pseudonymous user profiles. This means that from Google's point of view, the ads are not managed and displayed for a specifically identified person, but for the cookie owner, regardless of who this cookie owner is. This does not apply if a user has expressly allowed Google to process the data without this pseudonymization. The information collected about the users is transmitted to Google and stored on Google's servers in the USA.

For more information about Google's use of data, settings and objection options, please see Google's privacy policy (https://policies.google.com/technologies/ads) and the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

9 Provision of the website and creation of log files

a) Description and scope of data processing

Each time the portal is accessed, the operator’s system automatically records data and information from the computer system of the accessing computer.

The following data is collected:

• Information about the browser type and version used

• The user's operating system

• The user's Internet service provider

• The user's IP address

• Date and time of access

• Websites from which the user's system accesses the portal

• Websites accessed by the user’s system via the portal

The data is also stored in the log files of the operator's system. This data is not stored together with other personal data of the user.

b) Legal basis for data processing

The legal basis for the temporary storage of data and log files is Art. 6 (1) (f) GDPR.

c) Purpose of data processing

The temporary storage of the IP address by the operator's system is necessary to enable the portal to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the portal. The operator also uses the data to optimize the portal and to ensure the security of its information technology systems. The data is not evaluated for marketing purposes in this context.

These purposes also constitute the operator’s legitimate interest in data processing pursuant to Art. 6 (1) (f) GDPR.

d) Duration of storage

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. If the data is collected to provide the portal, this is the case when the respective session has ended.

If the data is stored in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the users' IP addresses are deleted or altered so that it is no longer possible to assign the calling client.

e) Possibility of objection and removal

The collection of data to provide the portal and the storage of data in log files is essential for the operation of the portal. Consequently, the user has no option to object.

10 Integration of third-party services and content

It may happen that third-party content, such as videos from YouTube, RSS feeds or graphics from other websites, is integrated into this portal. This always assumes that the providers of this content (hereinafter referred to as "third-party providers") perceive your IP address. Without the IP address, they would not be able to send the content to your browser. The IP address is therefore required to display this content. The operator endeavors to only use content whose respective providers only use the IP address to deliver the content. However, the operator has no influence if the third-party providers save the IP address, e.g. for statistical purposes. If the operator is aware of this, he will inform you about it.

The legal basis is Art. 6 Para. 1 lit. f GDPR.

11 SSL encryption

The operator uses SSL encryption for security reasons and to protect the transmission of confidential content, such as the requests you send to us as the portal operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL encryption is activated, the data you transmit to the operator cannot be read by third parties.

13 Status/Changes to the Privacy Policy

The current data protection declaration can be viewed at https://deutschegenossenschaft.de/datenschutz.