Privacy Policy

The controller responsible for data processing on this website is:

Data protection officer

Our company is not obliged to appoint a data protection officer (DPO). We have decided to appoint one voluntarily.

You can contact our data protection officer as follows:

• We only process personal data to the extent necessary to operate the website, to handle your enquiry or to initiate and perform a mandate.
• For clients, business partners and visitors, our privacy information pursuant to Art. 13, 14 and 21 GDPR also applies – available as a PDF download (in German).

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you visit the website, the web server automatically processes information transmitted by your browser (server log files):

• IP address of the requesting device
• date and time of access
• page or file requested (e.g. the download of the acquisition profile)
• amount of data transferred and status code
• previously visited page (referrer URL)
• browser type, browser version and operating system

This processing serves to deliver the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing a secure and functioning website. Log files are deleted after 56 days unless they are required to investigate a security incident. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

Encryption

This website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

If you contact us by e-mail or phone, we process the data you provide – such as your name, contact details, company and the content of your enquiry – in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

We use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, for our e-mail communication. Microsoft processes the data as our processor (Art. 28 GDPR). For transfers to countries outside the EU, see section 7.

Unencrypted e-mails may be read by third parties in transit. For confidential documents, please agree a suitable means of transmission with us in advance.

The acquisition profile can be downloaded without registration; only the server log files described in section 3 are processed.

If you send us property offers, property documents or a search profile, we process the personal data they contain (e.g. contact details of providers, owners or contact persons) in order to review the offer and to initiate or perform a mandate. The legal basis is Art. 6(1)(b) or (f) GDPR. Data is only passed on to clients or financing partners where this is necessary for the respective project. Where possible, please send tenant lists without the names of tenants.

Obligations under the German Anti-Money Laundering Act

As a real estate broker, we are obliged under the German Anti-Money Laundering Act (GwG) to identify our contractual partners and to record and retain the information collected. The legal basis is Art. 6(1)(c) GDPR in conjunction with Sections 10 et seq. GwG; records are generally retained for five years (Section 8(4) GwG).

Privacy information for clients and business partners

How we process personal data in the course of our business relationships – for example when initiating and performing mandates, identifying contractual partners under the German Anti-Money Laundering Act or working with banks, notaries and other parties – is explained in our privacy information pursuant to Art. 13, 14 and 21 GDPR. The document is available in German.

We refer to the LinkedIn profile of our Managing Director or the LinkedIn profile of the company by means of an external link. This is not an embedded plug-in: no data is transmitted to LinkedIn when you visit our website. Only when you click the link are you taken to LinkedIn, where the privacy policy of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland applies (linkedin.com/legal/privacy-policy).

We operate this social media presence as joint controllers together with the social media platform.

We only pass on personal data where this is legally permitted – for example to processors (hosting, e-mail, IT service providers), to tax advisors or authorities as part of statutory obligations, and to the parties involved in a mandate.

Data is not transferred to countries outside the European Union or the European Economic Area, or only subject to the requirements of Art. 44 et seq. GDPR.

We store personal data only for as long as necessary for the respective purpose. It is then deleted unless statutory retention obligations apply – in particular under German commercial and tax law (Section 257 HGB, Section 147 AO) or the Anti-Money Laundering Act.

You have the following rights with regard to your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object pursuant to Art. 21 GDPR: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, simply contact us using the details in section 1.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

You are not legally or contractually obliged to provide personal data; however, we cannot respond to your enquiry without your contact details. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

We will update this privacy policy whenever the website or the legal situation changes.