Privacy policy

Privacy policy and information according to Art 13 and 14 of DSGVO (GDPA)
[Datenschutz – Grundverordnung, General Data Protection Act]

Status as of 25.05.2018

We, HYPO NOE First Facility GmbH ("HYPO NOE"), herewith would like to inform you how we process your personal data and what rights you have pursuant to the Data Protection Act. The content and scope of the specific data processing depends on the products and services you have requested or agreed with.

1. Data processing responsible person

For the processing of your personal data the responsible person is:

HYPO NOE First Facility GmbH
FN [Company file number] 88229 z, Court of Second Instance, Vienna
Address: Ferdinandstraße 4, 1020 Wien
Tel.: + 43 1 614 24
Mail: datenschutz(at)

HYPO NOE Data Protection officer can be reached as follows:
Herr Mag. Thomas Hofer
Hypogasse 1, 3100 St. Pölten
Tel.: +43 5 90 910-1406
Mail: datenschutz(at)

2. Data processing, purpose, legal grounds, data transfer, storage duration

2.1. Homepage usage
We process some of your personal data when or in case you visit or browse our company webpage (

2.1.1 Processed data categories
In the course of data processing, the following personal data are collected:

  • date and time of a page opening from our company page;
  • your IP address;
  • the name of the retrieved file and the time of its retrieval;
  • the transferred amount of data;
  • success of data retrieval;
  • name and version of the web browser currently used by you;
  • website (URL), previously visited;
  • certain cookies:

2.1.2 Data processing purposes
Your data will be processed for the following purposes:

  • to provide you with the best possible access to this website, including related services and information, and to perform improvements and adjustments;
  • to prepare usage statistics;
  • to detect, prevent and investigate any attacks on / against our website.

2.1.3. Legal grounds of data processing
We are entitled to process your personal data based on:

  • your consent to the processing of your personal data - Art. 6, paragraph (1), item (a) of GDPA (General Data Protection Act) and Art. 96, paragraph (2) of the Telecommunication Act;
  • our predominant legitimate interest according to Art. 6, para. 1, item (f) of GDPA (General Data Protection Act), which consists in making the homepage more user-friendly and preventing possible attacks.

2.1.4. Transmission of your data concerning persons (personal data, Translator’s note)
For this topic, please, refer to Clause 3.

2.1.5. Data storage duration
Basically, the data processed by us are stored until consent renunciation. Longer storage may be required or necessary to investigate any reported attacks on / against the homepage and, in addition, only until the termination of relevant limitation periods, legal retention periods or any legal disputes, for which the data is required as evidence.

2.1.6. Cookies
Cookies are small text files and are used to determine the frequency of use and the number of users of our website. By using our website, you you agree to implement cookies. In your browser settings you can refuse to accept cookies. To see how this works in detail, please refer to your browser manufacturer's Guide. If you decide against certain technical and / or functional cookies, the functionality of our website may be restricted.

We use cookies (in particular Universal Analytics (and Google Remarketing), a web analytics service provided by Google Inc. ("Google")) to analyze the usage of our websites. We can analyze the online behavior in terms of time, geographical location, type and operating system of the device used (PC, laptop, tablet, mobile phone), browser used and website usage. This allows us to optimize the information available to users as well as the view on various devices (PC, laptop, tablet, mobile phone) and browsers (for example, displaying the nearest office).

The information generated by the cookie about your use of our website is usually transmitted to a Google server in the USA and stored there. However, by activating IP anonymization on this website, your IP address will be shortened by Google beforehand within thee member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases the complete IP address will be sent to a Google server in the US and shortened there.
The resulting information, including your truncated IP address in an anonymous form (the last four digits will not be displayed, allowing only rough localization) will be transferred to our server and stored for analysis purposes. They do not associate with data pertaining to individuals (personal data). The information on your use of this website will not be passed on to other third parties. The above-mentioned cookies from Google will remain stored on your device until you delete them.

2.2. Customers
We process product-related personal data that we have lawfully obtained from you in the context of a (possible) business relationship as well as from publicly available sources (for example land register, business register, association register)

2.2.1. Categories of processed data

  • Facility: address data, contact details, contract data

NOTE: The subject listing is a general presentation of data collected and processed in the course of the products concerned. The latter does not mean that we have, in any event, stored or processed all of your above-mentioned data. If you wish to receive a personalized reference, you may ask for it in the framework of your right to receive information under Article 15 of the GDPA [General Data Protection Act].

2.2.2 Legal grounds for processing
For the fulfillment of (pre-) contractual) obligations - Article 6, paragraph (1), item (b) of the GDPA:
We process your personal data for the execution of brokerage contracts, property management and construction management services. In addition, we process your personal data as far as necessary to carry out the contracts concluded with you.

  • To fulfill the legal obligations, to which we are subject, pursuant to Article 6, paragraph (1), item (c) of the GDPA.

2.2.3 Transmission of your data concerning persons (personal data, Translator’s note)

For this topic, please, refer to Clause 3.

2.2.4. Data storage duration
We will store the above-mentioned data for the purposes stated for the duration of the business relationship (from initiation to settlement to the termination of a contract) and beyond, in accordance with statutory retention and documentation requirements. Said inter alia derives from:

  • the Business Enterprise Code (UGB), applied to Austria (Translator’s note)
  • the Federal Tax Code (BAO)
  • In addition, within the storage period, the statutory limitation periods as per the General Civil Code (ABGB) that, in certain cases, may be up to 30 years (the general limitation period is 3 years), as outlined above as warranty terms and terms for the provision of guarantees should be observed.

2.3. Marketing activities

2.3.1. Categories of processed data

Address data, contact details

2.3.2. Targets of processing
Your data are being processed for the following purposes:

  • Preparation of individual proposals in line with your needs;
  • Invitations for events of HYPO NOE and its subsidiaries;
  • Sending product and service information (also for marketing purposes) by phone calls, fax and e-mail (E-Mail, SMS, messenger services)

2.3.3. Legal grounds for processing

  • In the case you have given your consent (Article 6, paragraph (1), item (a) (GDPA)

When we process your personal data on the basis of your consent, this consent determines the purpose and scope of the data processing. A consent can be revoked at any time, whereby a revocation makes the further processing for the future inadmissible.

  • Due to predominant legitimate interests according to Art. 6 para. 1 item (f) GDPA.
    The predominant legitimate interest of the Bank exists mainly in the following cases:
  • Analysis of marketing activities:
    The legitimate interest consists in measuring the efficiency of our marketing activities, as in offering appropriate products targeted to certain recipients;

Please, note that you are entitled to a refusal (see Section 7)

2.3.4. Transmission of your data concerning persons (personal data, Translator’s note)
For this topic, please, refer to Clause 3.

2.3.5. Data Storage Duration
The processing of data pertaining to persons (personal data, translator’s note) takes place in the case of data applications, which you have given your consent for, up to a revocation (see Clause 6). Furthermore, we will store the data for the stated purposes for the duration of the business relationship (from initiation for settlement to the termination of a contract), as well as in accordance with statutory retention and documentation requirements. Once the legitimate purposes are expired, we will delete the data.

3. Transmission of your data concerning persons (personal data, Translator’s note)
Your data will be passed on within HYPO NOE to persons or departments / entities that need them for the fulfillment of contractual, statutory and regulatory obligations as well as due to legitimate interests or processing activities based on your consent.
In the case of legal obligations, we must transfer your personal data to public authorities and institutions (tax and fiscal authorities).

4. Your rights in relation to personal data
Under current law, you are, inter alia, entitled to:

  • to check whether and which personal data we have stored about you and to obtain copies of this data;
  • request the correction, addition or deletion of your data pertaining to personal data that are being erroneously or improperly handled;
  • to require us to limit the processing of your personal data;
  • under certain circumstances, to refuse the processing of your personal data (or data pertaining to persons) or to waive any prior consent to the processing, and such a denial leaves the right of processing to the point of refusal unaffected. (Please, refer to Clause 6);
  • to require data portability;
  • Know the identity of third parties to whom your personal data are transferred and to file complaints with the data protection authority ( or a supervisory authority of another EU member state, especially where your place of residence or workplace is located.

5. Refusal of consent
Each of these consents may at any time (in writing or electronically) be revoked. The refusal should be addressed to your HYPO NOE customer advisor, respectively to the Data Protection Officer by e-mal to

The processing of data relating to persons is carried out up to revocation.

It is stated that the revocation applies ex nunc, which means that the data processing already performed on the basis of the consent remains unaffected. However, HYPO NOE complies with the deletion obligations in this regard. (Art. 17, GDPA). [Datenschutz – Grundverordnung].

6. Right to object
Please, note that you have the right, at any time for reasons that arise from your particular situation, to object to the processing of your personal data, which we process on the basis of prevailing interests; the same applies also to profiling based on these provisions. HYPO NOE will then no longer process such personal data unless it can demonstrate compelling legitimate grounds for processing that outweigh the interests, rights and freedoms of the data subject, or the processing is for the purpose of enforcing, pursuing or defending legal claims.

If personal data are processed to direct advertisements, you have the right at any time to object to the processing of any data relating to you for the purpose of such advertising; the latter also applies to profiling, if it is associated with such a direct advertisement.

7. Obligation for data disclosure
With regard to the personal data required to be entered and to carry out the business relationship and which we are legally obliged to collect, we request you to submit the same. If you refuse to do so, we will not be able to enter into or conclude a business relationship or contract with you, which is why we must terminate existing contractual relationships in this case.