1. Introduction
In this privacy statement we explain who we are, which personal data we process, why we do so (purpose), on the basis of which legal grounds, how long we retain your personal data, and what rights you have. We do this with the utmost care and in accordance with applicable laws and regulations.

Bouwinvest Real Estate Investors B.V. (hereinafter Bouwinvest) is a real estate asset manager established at La Guardiaweg 4, 1043 DG Amsterdam.

2. Definitions

In this privacy statement, the following definitions apply:

• Personal data: all information about an identified or identifiable natural person.
  

• Data subject: the person to whom the personal data relates.
  

• Processing: any operation performed on personal data, including collecting, recording, storing, consulting, sharing, and deleting.
  

• Controller: the party that determines the purpose and means of the processing.
  

• Processor: a party that processes personal data on behalf of Bouwinvest.
  

3. Who is responsible for the processing?

3.1 Controller
Bouwinvest is the controller within the meaning of Article 4 GDPR for all processing activities described in this privacy statement.

3.2 Processors, sub-processors and third-party recipients

In the course of our activities, we use (sub-)processors, including but not limited to:

• Real estate managers or property managers who manage Bouwinvest's property (MVGM, VB&T and Cushman & Wakefield);
  

• Maintenance parties;
  

• Screening and customer due diligence service providers;
  

• IT and cloud suppliers;
  

• Legal and tax advisers;
  

• Other service providers engaged by Bouwinvest for the performance of its tasks.
  

We conclude data processing agreements with these parties, which set out the arrangements for how they must handle personal data (for example, with regard to the security and confidentiality of personal data).

Recipients are parties such as the police, the tax authorities or other government agencies with which Bouwinvest is legally obliged to share personal data.

We obtain your personal data because you have provided it to us yourself, or because we receive it from third parties in the context of our services (or one of our other processing purposes), for example from property managers or from public sources such as the trade register or the land registry.

4. Categories of data subjects
This privacy statement covers, among other things, the processing of personal data of:

• Tenants and prospective tenants (see section 5).
  

• Shareholders and investors (see section 6).
  

• Applicants (see section 7).
  

• Suppliers, advisers and business relations (see section 8).
  

• Website visitors (see section 9).
  

5. (Prospective) Tenants and business relations

5.1 Purposes and legal basis for processing
Bouwinvest is the controller for the personal data of (prospective) tenants and business relations, including for the following purposes:

• Assessment of a rental application for a Bouwinvest property;
  

• Verification of identity and integrity;
  

• Performance of income and affordability checks;
  

• Performance of Customer Due Diligence (CDD);
  

• Compliance with obligations under the Sanctions Act 1977 and the Anti-Money Laundering and Counter-Terrorist Financing Act (Wwft);
  

• Entering into and executing tenancy agreements with Bouwinvest;
  

• Management, maintenance and operation of property;
  

• Rent collection, payment processing and debtor management;
  

• Handling of complaints and disputes;
  

• Prevention of fraud, misuse and criminal activity;
  

• Statutory and fiscal record-keeping obligations.
  

The legal basis is primarily the conclusion and performance of a tenancy agreement or a statutory obligation. For certain purposes, the basis is legitimate interest or your explicit consent.

MVGM, VB&T and Cushman & Wakefield are the property managers who, depending on the property you are renting, carry out the aforementioned tasks on behalf of Bouwinvest and process your personal data. Your tenancy agreement will indicate which property manager processes your personal data on behalf of Bouwinvest.

5.2 Client due diligence (pursuant to the Wwft and Sanctions Act)

5.2.1 Legal framework
Bouwinvest (licence number 15001195) is in certain cases an institution within the meaning of the Wwft and/or is required to comply with obligations under the Sanctions Act 1977. This obliges us to carry out appropriate client due diligence in respect of Bouwinvest's tenants and business relations.

5.2.2 Components of the CDD investigation
The CDD investigation may consist of:

• Identification and verification of the (prospective) tenant / representative of the business relation;
  

• Determination of ultimate beneficial owners (UBOs) where legal entities are involved;
  

• Establishing the purpose and intended use of the tenancy / business relationship;
  

• Risk classification (low, normal, elevated risk);
  

• Screening against:
  

  • Sanctions lists;
    

  • PEP lists (Politically Exposed Persons);
    

• Ongoing monitoring throughout the tenancy / business relationship;
  

• Enhanced due diligence where elevated risks are identified.
  

5.2.3 Specific Wwft obligations
Where elevated risks are present, we may request additional information regarding:

• The origin of financial resources (from reliable and independent sources);
  

• Financial position;
  

• Involvement in complex legal structures.
  

We are legally obliged to record and retain certain data and investigation results (for up to five years after the end of the tenancy / business relationship).

5.3 Types of personal data (tenants)
We may process, among other things, the following personal data:

Identification data

• Surname, first names, initials;
  

• E-mail address;
  

• Address;
  

• Gender;
  

• Date and place of birth;
  

• Nationality;
  

• Copy of identity document (redacted in accordance with the GDPR);
  

• Identification number (excluding BSN/citizen service number);
  

• Document type;
  

• Document date and country of issue;
  

• Document expiry date;
  

• Copy of the front and back of the document;
  

• Signature;
  

• Photograph.
  

Contact details

• Home address;
  

• E-mail address;
  

• Telephone number.
  

Financial and income data

• Pay slips;
  

• Employer's statement;
  

• Annual income statements;
  

• Bank account number (IBAN);
  

• Payment history.
  

CDD and integrity data

• Risk profile;
  

• Screening results;
  

• PEP status;
  

• Sanctions Act checks;
  

• UBO information;
  

• Internal risk classifications;
  

• Insolvency information;
  

• Status and status history in relation to sanctions, PEP and similar lists;
  

• Director disqualification;
  

• Information on law enforcement and the involvement of financial regulators;
  

• Existence of adverse media;
  

• Financial (income) data;
  

• Household composition (co-tenancy);
  

• UBO determination (ownership / control structure);
  

• Company information (activities);
  

• Name and signature of the company contact person completing the UBO form.
  

Contractual and usage data

• Tenancy agreements;
  

• Agreements with business relations;
  

• Correspondence;
  

• Complaints, repair requests;
  

• Inspection reports;
  

• Profession (for the purposes of municipal priority policies for key workers);
  

• Household composition (co-tenancy).
  

Technical and security data

• CCTV footage (where applicable);
  

• Log data from tenant portals.
  

5.4 Legal bases (tenants)
The processing operations are based on:

• Article 6(1)(b) GDPR – performance of / preparation for a contract;
  

• Article 6(1)(c) GDPR – legal obligation (Wwft, Sanctions Act);
  

• Article 6(1)(f) GDPR – legitimate interests, including:
  

  • Risk management;
    

  • Fraud and money laundering prevention;
    

  • Protection of property and investments.
    

5.5 Restrictions on rights in the context of Client Due Diligence
In the context of the Wwft and the Sanctions Act, certain rights of data subjects (such as access or erasure) may be restricted by law. In such cases, we will inform you of this in accordance with applicable legislation.

If a request to provide personal data is not complied with, Bouwinvest may, as a last resort, be compelled to terminate or not enter into the business relationship.

6. Shareholders and investors
Purposes

• Management of investment relationships;
  

• Fulfilment of contractual obligations;
  

• Statutory reporting;
  

• CDD/UBO investigation.
  

Data

• Business data;
  

• Identification data;
  

• Financial data;
  

• UBO information.
  

Legal bases

• Performance of a contract;
  

• Legal obligation;
  

• Legitimate interest.
  

7. Applicants
Purposes

• Recruitment and selection;
  

• Assessment of suitability;
  

• Communication regarding the application procedure.
  

Data

• First name and surname;
  

• E-mail address;
  

• Telephone number;
  

• CV data;
  

• Motivation;
  

• Assessments;
  

• Communication regarding the application procedure.
  

Processors

• For the application procedure, Bouwinvest uses processors.
  

Retention period

• Maximum 4 weeks after rejection;
  

• Maximum 1 year with consent after the end of the application procedure.
  

8. Suppliers, advisers and business relations
Purposes

• Contract management;
  

• Financial administration;
  

• Legal and tax obligations.
  

Personal data in this context refers to the name and business contact details of contact persons at organisations with which Bouwinvest contracts. The retention period for this data is in accordance with statutory requirements.

9. Automated decision-making and profiling

Bouwinvest does not use fully automated decision-making with legal consequences. For example, the allocation of property or the assignment of risk profiles in the context of CDD is always assessed by a member of staff.

10. CCTV surveillance
Where CCTV surveillance is applied at Bouwinvest properties, this is done:

• Exclusively for security purposes;
  

• With clear notification;
  

• With limited retention periods.
  

11. Transfer of data outside the EEA
Your personal data will in principle not be transferred outside the European Union. If a transfer of data outside the European Union does take place, and the country in question does not provide an adequate level of protection as referred to in Article 45 GDPR, the transfer will take place on the basis of appropriate safeguards as referred to in Article 46 GDPR, or in accordance with one of the conditions set out in Article 49 GDPR – for example, because the transfer is necessary for a contract between you and Bouwinvest or a contract concluded in your interest between Bouwinvest and a third party, or because you have consented to the transfer.

12. Visiting the Bouwinvest website & Cookies
In this cookie statement, we inform you about the use of cookies and similar technologies on our website. Cookies are small text files stored on your device when you visit one of our websites. They help us improve your user experience, optimise the functionality of our website and gain insight into how it is used. Please read on for more information about the types of cookies we use, their purposes and how you can manage your cookie settings. Your privacy is important to us and we want to ensure that you are well informed about how we handle your data.

What is a cookie?
A cookie is a simple, small file sent with pages from this website that your browser subsequently stores on your computer's hard drive. The information stored in the cookie may then be sent back to our servers during your next visit.

Types of cookies
What cookies do we use?
We use various types of cookies on our website(s). These include:

1. Functional cookies: These cookies are essential for the operation of the website and enable you to navigate the site and use its features, including access to secured sections of the site.
   

2. Preference cookies: These cookies enable the website to remember your preferences, such as your preferred language or the region in which you are located.
   

3. Statistics cookies: These cookies collect information about how visitors use the website. This helps us improve the performance of the site by gaining insight into popular pages and any issues that may arise.
   

What is a session cookie? We use session cookies on our websites. A session cookie enables us to see which parts of the website you have viewed during your visit. This in turn enables us to adapt our service as closely as possible to the browsing behaviour of our visitors. These cookies are automatically deleted when you close your web browser.

Do cookies contain information about who I am? Cookies on our website do not generally contain personal data of website visitors, such as your name, address or telephone number, unless you have specifically provided this information when completing the contact form. Our cookies are primarily used to ensure our website functions correctly and to store data about your use of the website, such as:

• Your preferences (e.g. language selection)
  

• Your activity on the website (e.g. pages visited, time spent on the site, clicks)
  

• Whether you have already performed a certain action (e.g. used the contact form)
  

Enabling, disabling and deleting cookies Further information on enabling, disabling and deleting cookies can be found in the instructions and/or via the Help function of your browser.

Google Analytics Via our website, the American company Google places a cookie as part of its Analytics service. We use this service to track how visitors use our website and to receive reports on this. Google may pass this information on to third parties if Google is legally required to do so, or insofar as third parties process the information on behalf of Google. We have no control over this. We have given Google permission to use the Analytics information it obtains for other Google services.

The information collected by Google is anonymised as much as possible. Your IP address is included. The information is transferred to and stored by Google on servers in the United States.

Why does Bouwinvest request consent for placing cookies? Bouwinvest expressly requests your consent to accept non-functional cookies and analytical cookies via our cookie banner. This is required by law. By clicking the button in the notification, you consent to the use of cookies. You may also refuse to accept these cookies. This may limit access to certain functionalities on our website.

Right to access, rectification or erasure of your data You have the right to request access to, rectification of, or erasure of your data. To prevent misuse, we may ask you to identify yourself. If this relates to personal data linked to a cookie, you will need to submit a copy of the relevant cookie. You can find this in your browser settings.

Questions and complaints If you have any remaining questions or complaints after reading this explanation, please use our contact form.

General
If you visit our website 'bouwinvest.nl', 'bouwinvest.com' and/or register for our newsletter via this website, we will process the personal data we require for this purpose.

In order to provide you as a visitor/user of our website(s) with an optimal user experience, we process a number of your personal data. The processing of personal data for this purpose serves the legitimate interests of Bouwinvest.

In addition, we wish to maximise our relevance to you and tailor the website to your preferences. We can do this by placing cookies, provided you have given your consent.

Please read our cookie policy for more information about which cookies we use and their purposes.

Personal data
The personal data we process for this purpose are: the IP address of your device, the web pages visited, your click and browsing behaviour, the internet browser you use, and the duration and time of your visit.

Completing a contact form
Purpose

To contact you in response to a question or request on your part:

• to ask a question
  

• to submit a comment
  

• to make a call-back request
  

Personal data
The personal data we process for this purpose are: first name, any middle name, surname and e-mail address.

Receiving a newsletter
Purpose

To keep you informed of new products, new property offerings, developments and general news about Bouwinvest. You must give your explicit consent to receive general newsletters and for the required processing of your data for that purpose. You may withdraw this consent at any time via the link at the bottom of the newsletters you receive.

Personal data
The personal data we process for this purpose are: first name, middle name, surname and e-mail address.

13. Retention periods

• Tenant data: up to 7 years after the end of the relationship;
  

• Wwft and Sanctions Act data: 5 years after the end of the relationship or the performance of the business transaction;
  

• Financial records: 7 years;
  

• Real estate transfer records: 10 years;
  

• CCTV footage: maximum 28 days;
  

• Applications: see section 7.
  

Personal data will not be retained for longer than necessary and will be deleted or anonymised after the established retention periods. Once personal data has been anonymised, it can never be traced back to an individual. Anonymised data may be used for research purposes.

14. Security measures
We attach great importance to the protection of personal data and take numerous measures for this purpose, including:

• Role and authorisation management;
  

• Encryption;
  

• Logging;
  

• Awareness training;
  

• Incident and data breach procedures;
  

• Audits.
  

15. Rights of data subjects
You have the right to:

• Access;
  

• Rectification;
  

• Erasure;
  

• Restriction of processing;
  

• Data portability;
  

• Objection.
  

Requests may be submitted to: privacy@bouwinvest.nl

Your request will be dealt with within one month of receipt. If this is not possible within one month — for example, due to a complex request — you will be informed of this within one month of receipt. The period may then be extended by one month. A request is usually free of charge. For exceptionally extensive requests, charges may be applied.

There may be circumstances in which we are entitled to (partially) refuse a request from a data subject. Where this is the case, any (partial) refusal will always be accompanied by reasons for the (partial) refusal of the request.

16. Data breaches
In the event of a data breach, we act in accordance with the GDPR and — where required — report the breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to the data subjects concerned.

17. Complaints and supervisory authority
Complaints may be directed to: privacy@bouwinvest.nl

If we are unable to resolve the matter, or if you wish to lodge a complaint directly with the Dutch Data Protection Authority, you may do so via the website of the Autoriteit Persoonsgegevens: www.autoriteitpersoonsgegevens.nl

18. Amendments
We reserve the right to amend this privacy statement. The most current version is always available on our website: www.bouwinvest.nl

May 2026