Data Protection

Protecting your privacy and your personal data is very important to us. We want to collect and process your personal data only with your knowledge and consent. Personal data within the meaning of this Policy are any information that may be related to you, i.e., your name, address, email address, IP address, and user behavior. In this Data Privacy Policy we explain to you what information we may store and for what purposes we might use such information. We agree to comply with all national and European data protection laws and regulations.

1. Controller and data protection officer (1) The controller within the meaning of Article 4 paragraph 7 of the General Data Protection Regulation (hereinafter "GDPR") and the service provider within the meaning of § 13 of the German Telemedia Act (hereinafter "TMG") is:

Groth u-invest Sechzehnte GmbH & Co. Studentenwohnen am Mauerpark KG Kurfürstendamm 63
10707 Berlin

Please direct any data protection related queries to our "data protection team" at datenschutz@investa.de

(2) The data protection officer of the controller can be reached at:

Groth u-invest Sechzehnte GmbH & Co. Studentenwohnen am Mauerpark KG Der Datenschutzbeauftragte Kurfürstendamm 63 10707 Berlin Email: datenschutz@studio-house.de

2. Source of personal data We will process personal data that we receive from you when your visit our website, when you contact us by email, or when you complete our contact form.

3. Categories of personal data that are processed (1) If you visit or use our website for information purposes only, i.e., if you do not register or otherwise transmit information to us, we will only collect personal data that are transmitted to our server by your browser. If you wish to view our website, we will collect the following data, which we need for technical reasons to show our website to you and to ensure stability and security: - your IP address - the date, time, and duration of your visit, - the content requested (specific page), - the access status/http-status code, - the data volume transmitted, - the website from which the request is received, - your browser, and - your operating system. Those data will be used exclusively for internal statistical purposes. (2) In addition to the aforementioned data, cookies will be stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive by your browser and that transmit certain information to the party that has placed the cookie. Cookies can execute no programs or transmit any viruses to your computer. Their purpose is to make the website as a whole more user-friendly and effective. (3) We use cookies to be able to recognize you the next time you visit our website, if you have created an account with us. Otherwise you will have to log in for each new visit. (4) Most browsers are configured by default to accept cookies. However, you can block cookies in your browser at any time or select settings in your browser to receive a notification as soon as a cookie is transmitted. Please note, however, that if you do so, you may not be able to use all functions of this website. (5) This stored information will be stored separately from any additional data you may have provided to us. In particular, data from cookies will not be linked to any other of your data.

4. Additional functions and services of our website (1) In addition to purely informational use of our website we offer various services that you may use if you are interested. To use those services you will generally have to provide additional personal data, which we will then use to provide the service you have selected and which are subject to the aforementioned data processing principles. (2) If you contact us by email or by using our contact form, the data you have provided (your email address, your name and, if applicable, your telephone number) will be stored by us in order to answer your questions. Data we receive in this connection will be erased as soon as their storage is no longer necessary, or, if we are subject to legal recordkeeping obligations, we will restrict the processing of such data.

5. Google Universal Analytics with IP anonymization (1) This website uses Google Universal Analytics with IP anonymization, a web analysis service of Google Inc. ("Google"). Google Universal Analytics uses cookies. Information about your use of this website generated by the cookie will generally be transferred to a Google server in the United States and stored there. By activating IP anonymization on this website your IP address will however be masked by Google within member states of the European Union or other signatory states to the Agreement on the European Economic Area before your data are transferred to the United States. On behalf of the operator of this website Google will use such information to analyze your use of the website, to prepare reports about website activities, and to provide additional services related to website use and Internet use to the website operator. (2) The IP address transmitted by your browser in connection with Google Universal Analytics will not be merged with any other data of Google. (3) Beyond the cookie settings of your browser you can also prevent Google from tracking data generated by the cookie about your use of the website (including your IP address) as well as from processing such data by downloading and installing the browser plug-in that is available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. (4) Please note that on this website Google Universal Analytics has been extended by the code "ga('set', 'anonymizeIp', true);" to guarantee anonymous tracking of IP addresses (so-called IP masking). As a result, IP addresses are processed in truncated form ruling out any possibility of associating an IP address directly with a particular person. (5) We use Google Analytics in order to be able to analyze and continuously improve use of our website. The statistical data generated by Google Analytics allow us to improve our products and services and to make them more interesting to you as a user. For exceptional cases in which personal data are transferred to the United States Google has committed to comply with the EU-US Privacy Shield. (6) Information about the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: https://www.google.com/analytics/terms/de.html, overview of data privacy: https://www.google.com/analytics/learn/privacy.html?hl=de, and data privacy policy: https://policies.google.com/privacy?hl=de&gl=de.

6. Integration of Facebook pixel (1) On this website we use the visitor activity pixel of Facebook based on our legitimate interest in analyzing, optimizing, and profitably operating our website. With this pixel we can track activities of users after they have viewed or clicked on a Facebook ad. We do this to track the effectiveness of Facebook ads both for statistical purposes as well as for market research purposes. Data are tracked in anonymous form, so that no personal data of individual users can be viewed by us. (2) The Facebook pixel allows Facebook to identify visitors to our website as a target group for Facebook ads. Facebook stores such data as user profiles and uses them for advertising and market research purposes and/or for designing its website in conformity with user preferences. Such an analysis is made in particular (whether or not users are logged in) to show advertising in conformity with user preferences and to inform other users of the social network about your activities on our website. (3) We neither have control over collected data or data processing procedures of Facebook nor do we know the full extent to which data are collected, the purposes for which data are collected, or for a long data are stored by Facebook. We also have no information about the erasure of data by Facebook. You can find additional information about data processing by Facebook at the following link: http://www.facebook.com/about/privacy. . (4) The visitor activity pixel will be used only with your consent in the form of an opt-out procedure. When you access our website you will be informed that we use the Facebook pixel. By clicking on the gray-shaded box you can prevent use of the Facebook pixel.

7. Categories of recipients of personal data (1) For some of the aforementioned processes and services we have carefully selected third-party service providers in conformity with applicable data protection law. Such third-party service providers are bound by our instructions and are audited by us on a regular basis. They will transfer no data to third parties. (2) In terms of transferring data to other recipients, we will transfer information about you only if we are required to do so by law, if you have consented, or if we otherwise have the right to transfer your data.

8. Purposes for which personal data are processed, and legal bases of data processing We will process your personal data in compliance with applicable data protection laws. Data processing is lawful if the following conditions are satisfied: Consent (Article 6 paragraph 1a) of the GDPR: Processing of your personal data is lawful if you have consented to processing for specific purposes (e.g., processing of your inquiry, use of data for marketing purposes). Your consent may be revoked at any time with effect for the future. This also applies to the revocation of consents you gave us before the GDPR took effect, i.e., prior to May 25, 2018. Legal requirements (Article 6 paragraph 1c) of the GDPR: GBP2 GmbH & Co. Bauprojekt KG is subject to various legal obligations, including the following: recordkeeping obligations under the German Commercial Code (HGB) and the German Tax Code (AO)

audit and reporting obligations under tax law Legitimate interests (Article 6 paragraph 1f) of the GDPR: To the extent necessary, we will process your data beyond the actual performance of the agreement with you to protect our rightful interests or those of third parties. For example, we may process your data: to assert legal claims or defend legal actions, to guarantee IT security and IT operation, or to analyze and improve use of our website.

9. Intent to transfer personal data to a third country or international organization Personal data will be actively transmitted to third countries only if this is expressly disclosed in connection with the aforementioned services.

10. Criteria for determining the duration for which personal data will be stored (1) Data will be stored in compliance with applicable data processing laws and in conformity with legal recordkeeping obligations. We will process and use data only for the purposes for which you have authorized us to process your data, and we will store data for as long as they are needed for those purposes. (2) If and when data are no longer needed for their purpose or for compliance with legal obligations, they will generally be erased unless continued processing of such data – for a limited time period and, where applicable, on a restricted basis – is necessary for any of the following purposes: Compliance with recordkeeping obligations under commercial or tax law: noteworthy are the German Commercial Code (HGB) and the German Tax Code (AO). These statutes provide for recordkeeping and/or documentation periods of up to 10 years. Preservation of evidence in connection with statute of limitations provisions: under §§ 195 et seq. of the German Civil Code (BGB) the standard limitation period is three years, but may be up to 30 years under special circumstances.

11. Your data privacy rights (1) Every data subject has a right to information under Article 15 of the GDPR, a right to rectification under Article 16 of the GDPR, a right to erasure under Article 17 of the GDPR, a right to restricted data processing under Article 18 of the GDPR, a right of revocation under Article 21 of the GDPR, and a right to data portability under Article 20 of the GDPR. The right to information and the right to erasure are subject to the limitations of §§ 34 and 35 of the Federal Data Protection Act (BDSG). In addition, every data subject has a right to lodge a complaint with a competent data protection regulatory authority (Article 77 of the GDPR in conjunction with § 19 of the Federal Data Protection Act (BDSG)). (2) Your consent to the processing of personal data by us may be revoked at any time with effect for the future, as is the case for consents that were given to us before the General Data Protection Regulation took effect, i.e., prior to May 25, 2018. (3) You have a right to object at any time to the processing of your personal data based on Article 6 paragraph 1 e) of the GDPR (data processing in the public interest) or Article 6 paragraph 1 f) of the GDPR (data processing on the basis of a legitimate interest) if the reasons for the objection involve special personal circumstances. If you object, we will no longer process your personal data unless we can show that there are compelling, protected reasons for processing your data that outweigh your interests, rights, and freedoms, and unless your data are processed to assert, exercise, or defend legal rights or claims. Objections may be made informally and, if possible, should be addressed as follows:

Groth u-invest Sechzehnte GmbH & Co. Studentenwohnen am Mauerpark KG Der Datenschutzbeauftragte Kurfürstendamm 63 10707 Berlin Email: datenschutz@studio-house.de

12. Obligation to make available personal data and potential consequences of failing to make available personal data In connection with using our services you must make available personal data which are necessary for achieving the purpose for which they are collected or which we are required to collect by law. Without those data, we will generally be unable to enter into or perform a contract with you.

13. Changes to this Data Privacy Policy We continuously develop and optimize our services. We may therefore add new functionalities. Should this have an impact on the way in which your personal data are processed, we will provide you with timely notice in our Data Privacy Policy.