At Bain Capital Credit MM S.à r.l. (hereinafter referred to as “we”), we place high importance on data privacy. The purpose of this data privacy policy is to inform you as potential tenants and visitors to this website about how we process your personal data and about your claims and rights under data privacy regulations. Personal data within the meaning of this data privacy information refer to all information relating to your person, e.g. name, address, contact details and date of birth (“personal data”).

1. Party responsible for data processing and contact details

The responsible party within the meaning of data protection law is:
Bain Capital Credit MM S.à r.l.
4, rue Lou Hemmer
L-1748 Findel
Luxembourg
Phone: +352 26 78 66 54
Email: mhuffling@baincapital.com

Contact details of data protection officer

2. Purposes for which your personal data is collected and processed and legal basis

We process personal data in accordance with the provisions set forth under the General Data Protection Regulation (“GDPR”), the Federal Data Protection Act (“BDSG”) and other applicable data protection regulations.


2.1 Fulfillment of contract or of pre-contractual measures (Art. 6 para. 1(b) GDPR)
We process your personal data for the purpose of preparing, establishing, executing and terminating lease agreements with you. This particularly includes pre-contractual and contract-related communication with you as well as corresponding invoicing and related payment transactions.
The legal basis for data processing described above is processing for fulfillment and execution of contract.
Provision of the aforementioned personal data is necessary in order to conclude and/or fulfill the contract you have entered into with us. If you fail to provide us with this data, we will typically have to refuse to conclude the contract. You are, however, not obliged to provide data that is not relevant to the fulfillment of the contract or that is not required by law.


2.2 Compliance with legal requirements (Art. 6 para. 1(c) GDPR)
We are subject to numerous legal obligations (e.g. under commercial and tax law). These includes legal obligations pertaining to data retention or obligations to provide information. We process your personal data in order to fulfill our legal obligations.


2.3 Purposes within the context of balancing of interests (Art. 6 para. 1(f) GDPR)
Based on the balancing of interests, data processing may be carried out by us or third parties in order to protect our legitimate interests. Data processing for the protection of legitimate interests takes place, for example, in connection with the provision of contact and/or lease information for due diligence activities conducted within the scope of the potential disposal of a rental property or in the context of communicating with contact persons of legal entities relevant to the contract. In this respect, we have an economic interest in using your data for these purposes, which constitutes a legitimate interest within the meaning of art. 6 para. 1(f) GDPR.


2.4 Purposes that fall within the scope of your consent (Art. 6 para. 1(a) GDPR)
Your personal data may also be processed for specific purposes on the basis of your consent. To the extent your data is processed based on your consent, we will notify you of this separately. You may revoke your consent at any time. Such revocation of consent is only effective for future data processing. Data processing that takes place before your revocation is not affected by such revocation and remains lawful.


2.5 Processing your data in the context of the use of the website
Notwithstanding the aforementioned data processing operations, your personal data will also be processed when you use this website.


2.5.1 Website provision and creation of log files
When you access our website, we automatically collect data from you.
(a) Personal data categories
The personal data we process when you use this website particularly includes type of web browser, the operating system you use, the domain name of your Internet service provider and your IP address.
We also store this data in the log files of our system.
(b) Purpose of processing
Processing personal data serves to ensure a stable connection to our website, effective use of our website, evaluation of system security and stability as well as optimization of our website.
(c) Legal basis
Processing is carried out in accordance with Art. 6 para. 1(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. We do not use your data to draw conclusions about your personal identity. We may anonymously evaluate this kind of information for statistical purposes in order to optimize our Internet presence and the technology behind it. Against this background, our main interest in processing your personal data is to enable you to use our website.
(d) Storage period
The data we collect is deleted as soon as it is no longer required for the purpose for which it was collected. This is generally the case for data that is used to provide our website when the respective session has ended.
For data stored in log files, this is the case after 14 days at the latest. Storage beyond this period is possible. In this case, user IP addresses are anonymized so that we can no longer identify the website visitor.
(e) Technical measures for the protection of personal data
To protect the security of your data during data transmission, we use state-of-the-art encryption procedures (e.g. SSL) via HTTPS.
(f) Obligation to provide personal data
The provision of the aforementioned personal data is neither legally nor contractually required. Without this data, however, the service and functionality of our website cannot be guaranteed. In addition, individual services may not be available or may be restricted.


2.5.2 Use of script libraries
(a) Use of Google Web Fonts
In order to display our content correctly and in a way that is visually appealing across browsers, we use Google Web Fonts (“Google Web Fonts”) on our website to display fonts.
Google Web Fonts is provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
(b) No data transfer to Google
We integrate these fonts via our own advertising servers and host them ourselves. That means that no personal data is transmitted to Google when Google Web Fonts are integrated.


2.6 Other purposes and change of purpose
If other purposes for data use arise in addition to the purposes already mentioned, we check whether these additional purposes are compatible and compliant with the original purpose of collection. If this is not the case, we will inform you of such change of purpose. If there is no other legal basis for further use of your data, we will not use your personal data without your consent.

3. Recipients or categories of recipients of your personal data

With regard to the information referred to under item 2, we also pass on your personal data to external companies. Recipients of your data within the scope of data processing activities described above are, in particular, IT service providers, external data centers, providers of support/maintenance services for EDP/IT applications, potential purchasers of rental properties, auditing firms, tax advisors, law firms, asset managers and property managers.

4. Transfer of data to a country outside the EU/EEA

Within the scope of data processing, we transfer your personal data to a country outside the European Union/the European Economic Area. For this transfer, we take appropriate protective measures in regard to the processing of your personal data. Please refer to the contact information provided under item 1 to obtain a copy of these protective measures.

5. Storage period of your personal data

Unless otherwise stated in this data privacy policy, we process your personal data for the duration of our business relationship with you. This also includes initiation of a contract (pre-contractual legal relationship) and execution of a contract.
In addition, we are subject to various retention and documentation obligations, which originate, inter alia, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The time periods specified therein for the retention and/or documentation are up to ten years after the end of the business relationship or the pre-contractual legal relationship.
In some cases, a longer retention period may be required due to legal statutes of limitation, for example, to preserve evidence.
If your personal data are no longer required for the fulfillment of contractual or legal obligations and rights, they will be deleted, unless (temporary) further processing is necessary for the fulfillment of the obligations and rights described under item 2 for an overriding legitimate interest or on the basis of consent. Such overriding legitimate interest also exists, for example, if deletion is not possible or is only possible with unreasonable effort due to the special nature of storing such data, and processing for other purposes cannot be implemented by appropriate technical and organizational measures.

6. Your rights

In accordance with the legal provisions, you may assert the following rights against us:

• You have the right to request information from us about the data we have stored about you pursuant to Art. 15 GDPR (if applicable, with limitations according to sec. 34 BDSG).
• Upon your request, we will correct the data stored about you in accordance with Art. 16 GDPR if such data is inaccurate or faulty.
• If you wish, we will delete your data in accordance with Art. 17 GDPR to the extent other legal regulations (e.g. statutory retention obligations or the restrictions set forth under sec. 35 BDSG) or an overriding interest on our part (e.g. for the defense of our rights and claims) are not in conflict with such deletion.
• With regard to the requirements laid out under Art. 18 GDPR, you can demand that we restrict the processing of your data.
• Pursuant to the requirements set forth under Art. 20 GDPR, you also have the right to obtain your data in a structured, common and machine-readable format or to pass it on to a third party.
• You have the right to file a complaint with a data protection supervisory authority (Art. 77 GDPR). Feel free to initially get in touch with our data protection officer.
• Furthermore, you may object to the processing of your data according to Art. 21 GDPR (for more information refer to the box).

To exercise these rights, you can contact us using the contact details provided under item 1.

Information about your right to object pursuant to Art. 21 GDPR

You have the right to object at any time to the processing of your data carried out on the basis of Art. 6 para. 1(f) GDPR (data processing based on balancing of interests) or Art. 6 para. 1(e) GDPR (data processing in public interest) if there are grounds arising from your particular situation. This also applies to profiling in reference to this provision within the meaning of Art. 4 no. 4 GDPR.
If you exercise your right to object, we will no longer process your personal data unless we can put forth compelling legitimate grounds for processing that override your interests, rights and freedoms, or such processing serves to assert, exercise or defend legal claims.
We also process your personal data in order to carry out direct advertising. If you do not wish to receive advertising, you have the right to object to this at any time; this also applies to profiling to the extent connected with such direct advertising. We will also observe such objection in future.
Objection can be made without any formalities and should be addressed to the contact details provided under item 1.