Privacy Policy

1. Introduction

Magis Asset Management B.V. (hereinafter Magis) takes the privacy of its (potential) residents and website guests, including their use of its (mobile) websites very seriously. We treat all the personal data of (potential) residents and website guests with great care and we always act in accordance with the applicable national and international data protection legislation.

The purpose of this privacy statement is to fully inform you about our privacy practices and the collection of personal data. This privacy statement sets out what type of personal data is collected from you, for what purposes we process your personal data, who has access to this personal data and how we use and protect this personal data. Most of the points are only applicable to (potential) residents, unless stated otherwise.

2. Use

This privacy statement applies to the processing of personal data by or on behalf of Magis (or its affiliate companies) a limited liability company registered under the laws of the Netherlands with its statutory seat in Eindhoven, the Netherlands, and its office at Stratumsedijk 50, Eindhoven, the Netherlands (5611NE), registered with the Dutch Chamber of Commerce under number 70098735. Magis is the legal entity that acts as the data controller for all its activities. Therefore, this privacy statement applies also to each separate accommodation of Magis or each separate accommodation managed by Magis and all of its affiliated parties.

3. What categories of personal data do we process and for what purposes?

We process your personal data based on specific legal grounds, dependent on the context, mainly including: your consent, the necessity for entering into or the performance of a contract with you, compliance with a legal obligation, or our legitimate interests, as permitted under the General Data Protection Regulation (GDPR) and applicable data protection laws.

Magis operates activities in the business of property management and rental.

We collect, store and process your personal data at five possible different stages: (i) before you make a booking at Magis or a residence managed by Magis, (ii) when you book a residence at Magis or a residence managed by Magis, or register for an interest list, (iii) during your stay at Magis or a residence managed by Magis, (iv) when you are accessing and using our (mobile) websites that are (co)owned or licensed by Magis (hereinafter: the ‘Website’) and your personal account on the Website and/or (v) after your stay at Magis or a residence managed by Magis.

(i) Before you make a booking at Magis or a residence managed by Magis:

When you visit the Website, either as a (potential) resident or website guest, we collect information about your use of the Website. For further information see section 7 “Analytics services and cookies” of this privacy statement.

You can also subscribe to a newsletter to receive the latest news about specific upcoming projects by registering for an interest list on the website. This newsletter contains the latest news about the upcoming project you are interested in, or housing availability updates. If you no longer wish to receive this newsletter, you can use the link provided in every newsletter to unsubscribe. Your data will be processed based on your consent. You have the right to withdraw this consent at any time.

You can also fill in a contact form on the Website in order to ask Magis a question. This contact form requires you to provide us with your name, mobile phone number (optional), email address, subject and comment/question to Magis. This information will be used and is necessary to process your question or comment and to allow us to communicate with you and contact you to answer your question. Your data will be processed based on your consent. You have the right to withdraw this consent at any time.

For the points below, the processing of data is necessary for drawing up or executing a rental contract, unless stated otherwise.

(ii) When you book a residence at Magis or a residence managed by Magis, or register for an interest list:

When you book a residence at Magis or a residence managed by Magis, or register for an interest list, you will need to fill in an online registration form on the Website. This registration requires you to provide us with your name, address, mobile phone number and email address, your stay preferences and/or the dates you are staying with us, nationality, gender and optionally, a short motivation. This information will be used and is necessary to process the booking, for billing purposes and to allow us to communicate with you about your booking. If needed, you can always edit or delete your information on your personal online portal. This data will be processed based on your request, in order to be able to enter into a (rental) agreement.

When we have confirmed the booking, we will send you a confirmation email and in addition to the personal data as mentioned above, you will provide us your place and date of birth, payment details (IBAN and BIC), whether you are working or a student, a copy of your passport (with information like the citizen service number crossed out) and – if applicable – the details of a guarantee. This information will be used and is necessary to process the confirmation of the booking and your further stay at Magis or a residence managed by Magis, such as approval and preparation of a (rental) agreement, for billing purposes and to allow us to communicate with you about your booking and your further stay at Magis or a residence managed by Magis.

As the application and contracting process takes place online, we request a copy of your passport to verify with whom we are entering into a rental agreement. Upon handover of the keys, we compare this copy with your original identity document.

Depending on the residence and your situation, we may also request supporting documents, such as proof of income (e.g. salary slips, an employment contract, an employer’s statement or a self-employed annual report), proof of enrolment at an educational institution for residences intended exclusively for students, or a statement from a previous landlord. These documents are used solely to assess your application, such as whether the rent is affordable for you or whether you meet the requirements for the residence.

(iii) During your stay at Magis or a residence managed by Magis:

During your stay at Magis or a residence managed by Magis, we could use the personal data as provided by you to Magis when you made the booking for the residence as mentioned above. This information will be used and is necessary to manage your stay at Magis or a residence managed by Magis, which includes, among other aspects, providing property management services, such as repairs and maintenance services or additional services, or to communicate with you and contact you, if necessary, about the property management services, or invoicing of the rent or charging for additional services during your stay.

During your stay at Magis or a residence managed by Magis, Magis could use CCTV-cameras in its buildings or the building that it manages. Magis has a legitimate interest to use these CCTV-cameras and these CCTV-cameras will be used and are necessary to secure the facilities and/or the properties of Magis and/or the properties of (potential) residents or other people staying at Magis or a residence managed by Magis and/or to prevent criminal offenses and/or to track down perpetrators and those involved in the case of criminal offenses. When Magis uses CCTV-cameras, it shall always inform you about the use of these CCTV-cameras at the entry of a building. Magis shall store the data of these CCTV-cameras for a maximum term of four weeks or longer if the camera has recorded an incident or legal offense. The processing of this data is necessary for the purpose of the legitimate interests of Magis as mentioned above.

During your stay at Magis or a residence managed by Magis, Magis could monitor energy-consumption data from the residence for the purpose of gaining insights into the energy efficiency of the residence, and for settling the energy costs with the tenant and sending invoices for this. This data is processed based on the obligations of the (rental) agreement. Magis could also actively monitor high energy consumers to send them energy-saving suggestions. This data is processed based on the legitimate interests of Magis to implement policies to make its properties more sustainable.

(iv) When making use of our additional services on the Website and your personal account:

By visiting and/or using the Website, you get access to your own personal account in order to book a residence and to use additional services and goods offered by Magis. Therefore, we would like to know a bit more about you and what your demands and needs are. This enables us to make your stay at one of our (managed) residences even more pleasant and to offer you the services that you need.

When you make use of our additional services on the Website and your personal account on the Website, we collect the following types of personal

• Your username, password and email address when you register for an online personal account;
• Profile information that you provide for your user profile (e.g., first and last name, phone number);
• User content (e.g., photos, comments, and other materials) that you post in your personal account;
• Your preferred payment method. The payment method (bank transfer, automatic collection) will ask you to provide some payment data. We will not process your payment data and/or details;
• Communications between you and Magis. For example, you may send us (service) requests. We may send you updates and news about the residence and city where you are staying, for which you can choose to opt out. Furthermore, we may send you service-related emails (e.g. account verification, changes/updates to features, technical and security notices). Note that you may not opt out of service-related emails.

(v) After your stay at Magis or a residence managed by Magis:

Please refer to point 12 ‘Retention’.

4. Who has access to your personal data?

(i) Internal / persons with access

Personal data of the Tenant and, if applicable, the Tenant's spouse/registered partner and/or other family members and/or curator/administrator are processed by the Landlord and/or the property manager (if any) and/or their group companies for the following purposes: The execution of the lease agreement, the (planning of) maintenance, making viewings and acquisitions, making payments and collecting claims including placing them in the hands of third parties, handling disputes, questions, or investigations including legal proceedings, exercising control, applying for and providing rent allowance, activities of internal management, as well as the implementation or application of a law.

(ii) External / categories of recipients

For these purposes, the personal data are provided by the landlord and/or manager, if necessary, to third parties such as the bank for payment purposes, maintenance companies that carry out scheduled maintenance or in response to a complaint (and to which name and contact details such as telephone number, email address and information about the complaint may be passed on), prospective tenants for viewings and takeovers (who may receive name, telephone number and email address to schedule an appointment), collection agencies, bailiffs, lawyers and judicial authorities in the context of a payment arrears or dispute, the tax authorities and other competent authorities, as well as service providers such as IT suppliers, providers of artificial intelligence (AI) services, energy supplier, accountants, auditors, security companies, insurers and for the purpose of services we offer such as parcel boxes and laundry services.

We use AI services to support our employees in internal administrative tasks, such as handling correspondence, searching and summarising documents, and preparing reports. These providers act as processors on our behalf, process personal data only on our instructions and under a data processing agreement, and are contractually not permitted to use your personal data to train their AI models.

We collect information about the use of our Website for statistical purposes, as also stated in section 7 “Analytics services and cookies”. This information tells us how well our Website is functioning. We only share this information with third parties in aggregated form, except with our analytics provider as described in section 7.

We may also provide your data to third parties if we are obliged to do so under national or international laws and regulations.

5. Your rights

You have the right to withdraw your consent at any time where we rely on your consent as the legal basis for processing. This will not affect the lawfulness of processing based on consent before its withdrawal. You also have the right to lodge a complaint with a supervisory authority, such as the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), if you believe your personal data has been processed unlawfully or your rights under data protection law have been infringed.

Regarding the personal data that Magis has collected and/or processed from you, you have the right to:

• Delete Data: You may request Magis to erase or delete all or some of the personal data we have collected and/or processed from you (e.g. if it is no longer necessary to provide services to you).
• Change or Correct Data: You may request Magis to change, update or fix the personal data, if you believe that the personal data that we process is incorrect, inaccurate or incomplete,
• Object to, or Limit or Restrict, Use of Data: You may request Magis to stop using all or some of your personal data (e.g. if we have no legal right to keep using it) or to limit our use of it (e.g. if your personal data is inaccurate or unlawfully held) and you have, at all times, the right to object against the processing of your personal data by Magis.
• Right to Access and/or Take Your Data: You can request Magis to provide an overview of the personal data we have collected and/or processed from you and you may request Magis to provide you with a copy of your personal data in a structured, commonly used, and machine-readable form.

You can make the above-mentioned requests by contacting our rental services at rent@magisrealestate.com.

Limitations of your rights

Data subject requests are free of charge. Only if a request is manifestly unfounded or excessive, in particular because of its repetitive character, may Magis charge a reasonable fee based on the administrative costs, or refuse to act on the request.

Before implementing a data subject request, Magis must be sure that the request is made by the person to whom the personal data relates. In most cases, a request sent from the email address known to us or made through your personal portal is sufficient. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it, for example by showing your identity document at our office or by sending a copy of it with your photo and citizen service number crossed out. Finally, in certain situations Magis may be entitled to legally refuse requests. In the event that Magis refuses to honor a request we will justify the reason why.

Right to contact the supervisory body

If you believe your data request is not being handled correctly, or that your personal data is processed unlawfully, you are entitled to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

6. How do we protect your personal data?

Magis takes all necessary technical and organizational measures to protect your personal data against loss or any form of unlawful use of any third party. A strictly limited number of people have access to your personal data, and access to your personal data is only granted when explicitly needed to provide our services to you or as otherwise stated in this privacy statement. Additionally, Magis has adopted a “Security First” policy with all third-party vendors, software companies, internal staff and contractors, meaning we only select those that share our core beliefs on security and privacy, and take the safety and security of your personal data as seriously as we do.

7. Analytics services and cookies

Magis uses cookies and similar technologies (e.g., web beacons, pixels and device identifiers) on the Website.

A cookie is a small file that is placed on your device when you visit the Website. We use two types of cookies:

• Functional cookies: these are necessary for the Website to function properly, for example to keep you logged in to your personal account, to remember your cookie preferences and to secure the Website. These cookies are always placed, as the Website cannot function without them.
• Analytics cookies: we use analytics services, such as Google Analytics, to analyze how visitors use the Website, so that we can improve it and tailor it to the needs of our visitors. We only place these cookies with your consent.

When you first visit the Website, we ask for your consent for non-functional cookies through our cookie banner. You can withdraw or change your consent at any time through the cookie settings on the Website or in your browser. Withdrawing your consent does not affect the lawfulness of processing based on consent before its withdrawal.

When analytics cookies are placed, the analytics provider may receive information such as your IP address, device identifier, browser type and operating system, the pages you visit and the website you came from. We use this information only for statistical analysis purposes and do not use it to identify you personally.

8. Transfer of personal data to other countries

We aim to process personal data within the European Economic Area (EEA). However, some of our service providers, including providers of AI services, are located in or process personal data in countries outside the EEA, in particular the United States.

Where personal data is transferred outside the EEA, we ensure an adequate level of protection by relying on Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework. In addition, we take supplementary measures, such as limiting the personal data shared to what is necessary for the specific task, using pseudonymised data where possible, applying access restrictions, and contractual agreements that prevent the use of your personal data for training AI models.

The safeguards used by our main service providers outside the EEA are published by these providers themselves:

• Anthropic (AI services): Data Processing Addendum
• Microsoft (office and communication software): Products and Services Data Protection Addendum
• Amazon Web Services (secure file storage): AWS GDPR Data Processing Addendum
• Google (website analytics): Google Ads Data Processing Terms

For transfers to other service providers, or if you would like more information about these transfers, you can contact our Data Protection Officer at dpo@magisrealestate.com.

9. Links to other websites

The Website may contain links to other websites. We cannot control these other external websites. Therefore, we will not be liable for the content of these websites, nor for the processing of personal data that may occur on these websites. We encourage you to evaluate the security and trustworthiness of these other websites and to read the privacy statements of these websites.

10. Copyright and other rights of Intellectual Property Rights

The (intellectual) property rights relating to the content and design of the online platform, personal account, and Website of Magis, including but not limited to text, data files, photos and (still and / or moving) images and audio material are owned by Magis, its partners or its licensors.

Reproduction (including processing) and / or disclosure of content and design of the platforms or the Website of Magis is prohibited without the prior written consent of Magis.

11. Adjustments to this Privacy Statement

Magis reserves the right to make changes to this privacy statement. The most current and applicable version of this privacy statement can always be found on our Website.

12. Retention

(i) Website guests

After the personal data is processed, this data is directly anonymized and the personal data is no longer saved.

(ii) Potential residents

We store your personal data in a profile that will remain on our server until your account has been closed, either through a request sent to us by email, or by using the ‘withdraw application’ button in your personal portal.

(iii) Residents

After you leave Magis or a residence managed by Magis, we will store your personal data in a profile if and as long as necessary for us to fulfill our and/or your contractual obligations; or if and as long as it is necessary to perform functions you have granted us consent for; or if and as long as we are obliged to do so under national or international (tax) laws and regulations.

(iv) Identity documents and supporting documents

Notwithstanding the retention periods described above, copies of identity documents and the supporting documents described in section 3 (ii) are retained only for as long as necessary for these purposes. For residents, these documents are automatically deleted 30 days after check-in. For potential residents, they are deleted after 30 days of inactivity on your account. You can always delete your personal documents, or your entire Magis account, through your personal portal, as long as there is no (active) booking on your account.

13. Questions

In case you have any questions regarding this privacy statement, you may send an email to rent@magisrealestate.com.

14. Data Protection Officer (DPO) Contact Details

Magis has appointed a Data Protection Officer to oversee our compliance with data protection laws. Should you have questions or concerns about our data processing practices, or wish to exercise your data subjects' rights, you may contact our Data Protection Officer at: dpo@magisrealestate.com.