PRIVACY POLICY

​

Preamble

This privacy policy explains the types of personal data (also referred to below as ‘data’) we process, the purposes of processing and its scope. It applies to all processing of personal data by us, both in providing our services and, in particular, on our websites, in mobile applications and on external online presences such as our social media profiles (collectively referred to below as our ‘online services’).

The terms used are gender-neutral.

Last updated: 18 January 2026

 

Contents

• Preamble

• Controller

• Overview of processing

• Relevant legal bases

• Security measures

• Disclosure of personal data

• International data transfers

• General information on data retention and deletion

• Rights of data subjects

• Business services

• Business processes and procedures

• Providers and services used in our business activities

• Provision of online services and web hosting

• Use of cookies

• Data processing within the application (app)

• Contact and enquiry management

• Communication via messaging services

• Artificial intelligence (AI)

• Cloud services

• Web analytics, monitoring and optimisation

• Online marketing

• Customer reviews and rating procedures

• Social media presences

• Plug-ins, embedded functions and content

• Changes and updates

• Definitions

​

Controller

FINK GMBH
Kaiserstraße 3
67292 Kirchheimbolanden
Germany

Authorised representative: Jürgen Fink

Email address: kontakt@finkimmobilien.de

Phone: 06352 - 5721

Legal notice: https://www.fink-immobilien.com/en/impressum

​

Overview of processing

The following overview summarises the types of data processed and the purposes of processing, and identifies the people concerned.

Types of data processed

• Basic personal data.

• Payment data.

• Location data.

• Contact data.

• Content data.

• Contract data.

• Usage data.

• Metadata, communication data and procedural data.

• Event data (Facebook).

• Log data.

Categories of data subjects

• Service recipients and clients.

• Employees.

• Prospective customers.

• Communication partners.

• Users.

• Members.

• Business and contractual partners.

• Third parties.

• Customers.

Purposes of processing

• Providing contractual services and fulfilling contractual obligations.

• Communication.

• Security measures.

• Direct marketing.

• Audience measurement.

• Tracking.

• Office and organisational procedures.

• Conversion measurement.

• Audience targeting.

• Organisational and administrative procedures.

• Feedback.

• Marketing.

• Profiles containing user-related information.

• Providing our online services and improving usability.

• Information technology infrastructure.

• Financial and payment management.

• Public relations.

• Sales promotion.

• Business processes and commercial procedures.

• Artificial intelligence (AI).

​

Relevant legal bases

Relevant legal bases under the GDPR: The following is an overview of the GDPR legal bases on which we process personal data. Please note that, in addition to the GDPR, national data protection rules may apply in your country of residence or establishment or in ours. Where more specific legal bases apply in an individual case, we will inform you in this privacy policy.

• Consent (Article 6(1), first sentence, point (a) GDPR): The data subject has consented to processing their personal data for one or more specific purposes.

• Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR): Processing is necessary to perform a contract to which the data subject is a party or to take steps at their request before entering into a contract.

• Legal obligation (Article 6(1), first sentence, point (c) GDPR): Processing is necessary to comply with a legal obligation to which the controller is subject.

• Legitimate interests (Article 6(1), first sentence, point (f) GDPR): Processing is necessary for the legitimate interests pursued by the controller or a third party, unless these are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data.

National data protection rules in Germany: In addition to the GDPR, national data protection rules apply in Germany, particularly the Federal Data Protection Act (BDSG), which protects against misuse of personal data in data processing. The BDSG contains specific provisions on access, erasure, objection, processing special categories of personal data, processing for other purposes, disclosure and automated individual decision-making, including profiling. The data protection laws of individual German federal states may also apply.

Application of the GDPR and the Swiss Federal Act on Data Protection: This policy provides information under both the Swiss Federal Act on Data Protection (FADP) and the GDPR. For broader geographical applicability and clarity, it uses GDPR terminology. In particular, GDPR terms such as ‘processing’, ‘personal data’, ‘legitimate interests’ and ‘special categories of data’ replace the corresponding Swiss statutory terms. Where the Swiss FADP applies, however, the legal meaning of these terms continues to be determined under Swiss law.

Security measures

In accordance with legal requirements, we implement appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. We take account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the varying likelihood and severity of risks to individuals’ rights and freedoms.

These measures include safeguarding data confidentiality, integrity and availability by controlling physical and electronic access, data entry and disclosure, availability and separation of data. We have also established procedures for exercising data subject rights, deleting data and responding to threats to data security. We consider personal data protection when developing or selecting hardware, software and procedures, in accordance with the principles of data protection by design and by default.

Securing online connections using TLS/SSL encryption (HTTPS): We use TLS/SSL encryption to protect data transmitted through our online services against unauthorised access. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) provide encryption for information transmitted between a website or app and a user’s browser, or between two servers. TLS is the more advanced and secure successor to SSL. An SSL/TLS certificate is indicated by HTTPS in the URL, signalling that information is transmitted over an encrypted connection.

Disclosure of personal data

When processing personal data, we may transmit it to or disclose it to other bodies, companies, legally independent organisational units or individuals. Recipients may include IT service providers or providers of services and content integrated into a website. In such cases we comply with legal requirements and, in particular, enter into appropriate contracts or agreements with recipients to protect your data.

International data transfers

Processing in third countries: Where we transfer data to a third country, meaning outside the European Union (EU) or European Economic Area (EEA), including when using third-party services or disclosing or transferring data to other people, bodies or companies, we do so in accordance with legal requirements. Such transfers may be indicated by the provider’s postal address or by an express reference in this policy to transfers to third countries.

For transfers to the United States, we rely primarily on the Data Privacy Framework (DPF), recognised as providing an adequate legal framework by the European Commission’s adequacy decision of 10 July 2023. We have also entered into standard contractual clauses with the relevant providers, meeting the Commission’s requirements and establishing contractual obligations to protect your data.

These two safeguards are intended to protect your data: the DPF provides the primary framework, while the standard contractual clauses provide an additional safeguard. If the DPF framework changes, the standard contractual clauses serve as a fallback mechanism, helping to maintain appropriate protection in the event of political or legal changes.

For individual service providers, we explain whether they are DPF-certified and whether standard contractual clauses apply. Further information about the DPF and a list of certified companies are available on the US Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Transfers to other third countries are subject to corresponding safeguards, particularly standard contractual clauses, express consent or transfers required by law. Information on third-country transfers and applicable adequacy decisions is available from the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

​

General information on data retention and deletion

We delete personal data in accordance with the law when the underlying consent is withdrawn or no further legal basis for processing exists. This includes cases where the original processing purpose no longer applies or the data is no longer needed. Exceptions apply where legal obligations or specific interests require longer retention or archiving.

In particular, data that must be retained for commercial or tax-law purposes, or is needed to pursue legal claims or protect the rights of other individuals or legal entities, must be archived accordingly.

This policy provides additional retention and deletion information for particular processing activities.

Where several retention periods or deletion deadlines apply to the same data, the longest period applies. Data retained for legal or other reasons after the original purpose has ended is processed solely for the purposes that justify its retention.

Data retention and deletion: The following general retention and archiving periods apply under German law:

• 10 years: Books and records, annual accounts, inventories, management reports, opening balance sheets and the instructions and other organisational documents needed to understand them (section 147(1), no. 1 in conjunction with (3) German Fiscal Code (AO), section 14b(1) German VAT Act (UStG), section 257(1), no. 1 in conjunction with (4) German Commercial Code (HGB)).

• 8 years: Accounting documents, such as invoices and expense receipts (section 147(1), nos. 4 and 4a in conjunction with (3), first sentence AO, and section 257(1), no. 4 in conjunction with (4) HGB).

• 6 years: Other business records, including received commercial or business correspondence, copies of correspondence sent and other tax-relevant documents, such as hourly pay records, cost allocation sheets, calculation documents, price records, payroll documents that are not already accounting documents, and cash register receipts (section 147(1), nos. 2, 3 and 5 in conjunction with (3) AO, and section 257(1), nos. 2 and 3 in conjunction with (4) HGB).

• 3 years: Data needed to consider potential warranty, damages or similar contractual claims and rights, and to handle related enquiries, is retained for the ordinary statutory limitation period of three years, based on previous business experience and customary industry practice (sections 195 and 199 German Civil Code (BGB)).

​

Rights of data subjects

Data subject rights under the GDPR: You have various rights under the GDPR, particularly under Articles 15 to 21:

• Right to object: You may object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1), points (e) or (f) GDPR, including profiling based on those provisions. Where your personal data is processed for direct marketing, you may object at any time to processing for that purpose, including profiling to the extent it relates to such marketing.

• Right to withdraw consent: You may withdraw consent at any time.

• Right of access: In accordance with the law, you may request confirmation of whether your data is being processed, access to that data, further information and a copy of the data.

• Right to rectification: In accordance with the law, you may request completion of your data or correction of inaccurate personal data.

• Rights to erasure and restriction of processing: Subject to the applicable legal conditions, you may request deletion of your data without undue delay or, alternatively, restriction of its processing.

• Right to data portability: Subject to the applicable legal conditions, you may receive personal data you have provided to us in a structured, commonly used, machine-readable format or request its transmission to another controller.

• Right to complain to a supervisory authority: In accordance with the law and without prejudice to other administrative or judicial remedies, you may lodge a complaint with a data protection supervisory authority, particularly in the member state of your habitual residence, workplace or the alleged infringement, if you consider that processing of your personal data infringes the GDPR.

​

Business services

We process data of our contractual and business partners, such as customers and prospective customers (collectively ‘contractual partners’), within contractual and comparable legal relationships, related measures and communication, including pre-contractual communication such as responding to enquiries.

We use this data to fulfil our contractual obligations, particularly to provide agreed services, meet any updating duties and address warranty or other service issues. We also use it to protect our rights and for associated administration and business organisation. In addition, we process data based on our legitimate interests in proper, commercially sound business management and security measures protecting our partners and business against misuse and risks to data, secrets, information and rights. This may involve telecommunications, transport and other support providers, subcontractors, banks, tax and legal advisers, payment providers or tax authorities. Within the law, we disclose partners’ data to third parties only where necessary for these purposes or to fulfil legal obligations. This policy explains other forms of processing, such as marketing.

We inform contractual partners which data is required before or when collecting it, for example through specific markings, colours or symbols such as asterisks in online forms, or in person.

We delete data when statutory warranty and comparable obligations expire, generally after four years, unless it is retained in a customer account or must be archived for legal reasons, for example for tax purposes, generally for ten years. Data disclosed to us by a contractual partner in connection with an assignment is deleted in accordance with the applicable requirements, generally after the assignment ends.

• Types of data processed: Basic personal data (for example full name, home address, contact details and customer number); payment data (for example bank details, invoices and payment history); contact data (for example postal addresses, email addresses and phone numbers); contract data (for example subject matter, term and customer category).

• Data subjects: Service recipients and clients; prospective customers; business and contractual partners.

• Purposes of processing: Providing contractual services and fulfilling contractual obligations; communication; office and organisational procedures; organisational and administrative procedures; business processes and commercial procedures.

• Retention and deletion: Deletion in accordance with the section ‘General information on data retention and deletion’.

• Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legal obligation (Article 6(1), first sentence, point (c) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

​

Further information on processing activities, procedures and services:

• Agency and brokerage services: We process data of our customers, clients and prospective customers (collectively ‘customers’) in accordance with their underlying instructions. We may also process information about individuals’ characteristics and circumstances, or their property, where this forms part of our assignment. This may include personal circumstances, movable or immovable property and financial circumstances.
  
  Where necessary to perform a contract, required by law, authorised by customers or based on our legitimate interests, we disclose or transfer customers’ data in connection with coverage enquiries, contract conclusion and administration to providers of the arranged services or properties, insurers, reinsurers, broker networks, technical and other service providers, cooperating associations, financial services providers, credit institutions, investment companies, social security institutions, tax authorities, tax advisers, legal advisers, auditors, insurance ombudsmen and Germany’s Federal Financial Supervisory Authority (BaFin). Unless otherwise agreed, we may also appoint subcontractors, such as sub-agents. Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR).

​

Business processes and procedures

Personal data of service recipients and clients, including customers, clients and, in particular cases, patients or business partners and other third parties, is processed within contractual and comparable legal relationships and pre-contractual measures such as establishing business relationships. This processing supports business activities including customer management, sales, payments, accounting and project management.

The data is used to fulfil contractual obligations and organise efficient business processes. This includes handling transactions, managing customer relationships, optimising sales strategies and ensuring internal accounting and financial processes. It also supports protection of the controller’s rights, administrative tasks and business organisation.

Personal data may be disclosed to third parties where necessary to fulfil these purposes or legal obligations. It is deleted when statutory retention periods expire or its processing purpose ends. This also applies to data retained for longer to meet tax-law or statutory evidence requirements.

• Types of data processed: Basic personal data (for example full name, home address, contact details and customer number); payment data (bank details, invoices and payment history); contact data (postal addresses, email addresses and phone numbers); content data (text or image messages and posts and related information, such as authorship or creation time); contract data (subject matter, term and customer category); log data (for example logs of sign-ins, data retrieval and access times); usage data (page views, time spent, click paths, intensity and frequency of use, device types, operating systems and interactions with content and functions); metadata, communication data and procedural data (IP addresses, times, identification numbers and people involved).

• Data subjects: Service recipients and clients; prospective customers; communication partners; business and contractual partners; third parties; users, such as website visitors and online service users; employees, including staff, applicants and temporary workers; customers.

• Purposes of processing: Providing contractual services and fulfilling contractual obligations; office and organisational procedures; business processes and commercial procedures; communication; marketing; sales promotion; public relations; financial and payment management; IT infrastructure, including operating and providing information systems and equipment such as computers and servers.

• Retention and deletion: Deletion in accordance with the section ‘General information on data retention and deletion’.

• Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR); legal obligation (Article 6(1), first sentence, point (c) GDPR).

Further information on processing activities, procedures and services:

• Customer management and customer relationship management (CRM): Procedures needed for customer management and CRM, including customer acquisition in compliance with data protection rules, customer retention and loyalty, effective communication, complaints handling and customer service with due regard to data protection, data management and analysis supporting relationships, CRM administration, secure account management, customer segmentation and audience targeting. Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

• Contact management and maintenance: Procedures for organising, maintaining and safeguarding contact information, including a central contact database, regular updates, data integrity checks, data protection measures, access controls, backups and restoration, staff training in contact management software, review of communication histories and adjustment of contact strategies. Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

• General payment transactions: Procedures for making payments, monitoring bank accounts and controlling payment flows, including preparing and checking transfers, handling direct debits, reviewing statements, monitoring receipts and payments, managing returned direct debits, reconciling accounts and cash management. Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

• Bookkeeping, accounts payable and accounts receivable: Procedures for recording, processing and checking business transactions in accounts payable and receivable, including preparing and reviewing invoices, managing outstanding items, payments, reminders, reconciliation of receivables and liabilities, and creditor and debtor accounting. Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legal obligation (Article 6(1), first sentence, point (c) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

• Financial accounting and taxes: Procedures for recording, managing and reviewing financial transactions and calculating, reporting and paying taxes, including allocating and posting transactions, quarterly and annual accounts, payments, reminders, reconciliation, tax advice, preparing and submitting returns, and tax administration. Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legal obligation (Article 6(1), first sentence, point (c) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

• Marketing, advertising and sales promotion: Procedures including market analysis, identifying audiences, developing marketing strategies, planning and running campaigns, designing and producing materials, online marketing including SEO and social media campaigns, event marketing, trade fairs, loyalty programmes, sales promotions, performance measurement and optimisation, budget management and cost control. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).

• Public relations: Procedures including communication strategies, PR campaigns, preparing and distributing press releases, media contacts, monitoring and analysing coverage, press conferences and public events, crisis communication, social media and website content, and corporate branding. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).

 

Providers and services used in our business activities

In our business activities we use additional third-party services, platforms, interfaces or plug-ins (collectively ‘services’) in compliance with legal requirements. Their use is based on our interests in proper, lawful and commercially sound operation and internal organisation.

• Types of data processed: Basic personal data (for example full name, home address, contact details and customer number); payment data (bank details, invoices and payment history); contact data (postal addresses, email addresses and phone numbers); content data (text or image messages and posts, including related authorship and creation information); contract data (subject matter, term and customer category).

• Data subjects: Service recipients and clients; prospective customers; business and contractual partners; members; employees, including staff, applicants and temporary workers.

• Purposes of processing: Providing contractual services and fulfilling contractual obligations; office and organisational procedures; business processes and commercial procedures.

• Retention and deletion: Deletion in accordance with the section ‘General information on data retention and deletion’.

• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

• DATEV: Software for accounting, communication with tax advisers and authorities, and document storage. Provider: DATEV eG, Paumgartnerstr. 6–14, 90429 Nürnberg, Germany. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://www.datev.de/web/de/mydatev/datev-cloud-anwendungen/; Privacy policy: https://www.datev.de/web/de/m/ueber-datev/datenschutz/. Data processing agreement: Provided by the service provider.

• Lexware: Software for invoicing, accounting, banking, tax filing and document storage. Provider: Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://www.lexoffice.de/datenschutz/. Privacy policy: https://datenschutz.lexware.de/.

Provision of online services and web hosting

We process users’ data to provide our online services. This includes the user’s IP address, which is needed to transmit content and functions to their browser or device.

• Types of data processed: Usage data (page views, time spent, click paths, intensity and frequency of use, device types, operating systems and interactions with content and functions); metadata, communication data and procedural data (IP addresses, times, identification numbers and people involved); log data (for example logs of sign-ins, data retrieval and access times); content data (text or image messages and posts and related information, such as authorship and creation time).

• Data subjects: Users, such as website visitors and online service users.

• Purposes of processing: Providing our online services and improving usability; IT infrastructure, including operating and providing information systems and equipment such as computers and servers; security measures.

• Retention and deletion: Deletion in accordance with the section ‘General information on data retention and deletion’.

• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

• Providing online services using rented storage: We use storage space, computing capacity and software rented or otherwise obtained from a server provider, also known as a web host. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).

• Access data and log files: Access to our online services is recorded in server log files. These may contain the address and name of pages and files retrieved, date and time, data volumes, retrieval success messages, browser type and version, operating system, referrer URL (the previous page), and generally IP addresses and the requesting provider. Logs may be used for security, for example to prevent server overload, particularly during abusive DDoS attacks, and to ensure server capacity and stability. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Deletion: Log information is retained for no more than 30 days, then deleted or anonymised. Data required as evidence is exempt from deletion until the incident is finally resolved.

• Content delivery network: We use a content delivery network (CDN). A CDN enables content, particularly large media files such as graphics or scripts, to be delivered more quickly and securely through geographically distributed servers connected over the internet. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).

• Wix: Hosting and software for creating, providing and operating websites, blogs and other online services. Provider: Wix.com Ltd., Nemal St. 40, 6350671 Tel Aviv, Israel. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://de.wix.com/; Privacy policy: https://de.wix.com/about/privacy; Data processing agreement: https://www.wix.com/about/privacy-dpa-users. Basis for third-country transfers: Data Privacy Framework (DPF).

• Google Cloud CDN: Content delivery network enabling content, particularly large media files such as graphics or scripts, to be delivered more quickly and securely through geographically distributed servers connected over the internet. Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://cloud.google.com/cdn; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://cloud.google.com/terms/data-processing-addendum. Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses (https://cloud.google.com/terms/eu-model-contract-clause).

​

Use of cookies

‘Cookies’ refers to functions that store information on users’ devices and read it from them. They may serve different purposes, including online service functionality, security, convenience and visitor traffic analysis. We use cookies in accordance with the law and obtain consent beforehand where required. Where consent is not required, we rely on legitimate interests. This applies where storing or accessing information is essential to provide content or functions explicitly requested, such as storing preferences and ensuring functionality and security. Consent may be withdrawn at any time. We clearly explain its scope and the cookies used.

Legal bases under data protection law: Processing personal data using cookies depends on consent where required. Where consent has been given, it is the legal basis. Otherwise, we rely on the legitimate interests explained above and in relation to the relevant services and procedures.

Storage duration: The following types of cookies are distinguished by their storage period:

• Temporary cookies, also known as session cookies: These are deleted at the latest when a user has left the online service and closed their browser or mobile application.

• Persistent cookies: These remain stored after the browser or application is closed. They can, for example, retain sign-in status and show preferred content on a return visit. Data collected using cookies may also be used for audience measurement. Unless we provide specific information about a cookie’s type and duration, for example when requesting consent, users should assume it is persistent and may be stored for up to two years.

General information on withdrawal of consent and objection (opt-out): Users may withdraw consent at any time and object to processing in accordance with the law, including through their browser’s privacy settings.

• Types of data processed: Metadata, communication data and procedural data, such as IP addresses, times, identification numbers and people involved.

• Data subjects: Users, such as website visitors and online service users.

• Legal bases: Legitimate interests (Article 6(1), first sentence, point (f) GDPR); consent (Article 6(1), first sentence, point (a) GDPR).

Further information on processing activities, procedures and services:

• Consent-based processing of cookie data: We use a consent management solution to obtain consent to cookies and to the procedures and providers identified in that solution. It obtains, records, manages and enables withdrawal of consent, particularly for cookies and comparable technologies that store, access and process information on users’ devices. Users may manage and withdraw their consent. Consent records are stored to avoid repeated requests and to demonstrate consent as legally required. They are stored on the server and/or in an opt-in cookie or comparable technology to associate consent with a particular user or device. Unless more specific provider information is given, consent is retained for up to two years. A pseudonymous user identifier is stored with the time of consent, its scope, such as cookie categories or providers, and information about the browser, system and device. Legal basis: Consent (Article 6(1), first sentence, point (a) GDPR).

• Cookie opt-out: A button link in our website footer lets you change cookie settings and withdraw the relevant consent.

• Usercentrics: Storage and management of consent to cookies and data processing, recording user decisions, displaying privacy and cookie information, and enabling users to withdraw or adjust consent. Provider: Usercentrics GmbH, Sendlinger Straße 7, 80331 München, Germany. Website: https://usercentrics.com/de/. Privacy policy: https://usercentrics.com/de/datenschutzerklaerung/.

 

Data processing within the application (app)

We process app users’ data to the extent necessary to provide the app and its functions, monitor security and develop it further. In accordance with the law, we may contact users where communication is necessary to administer or use the app. Other processing of users’ data is described in the relevant sections of this privacy policy.

Legal bases: Processing necessary to provide app functions serves performance of contractual obligations. This also applies where a function requires user permissions, such as access to device functions. Processing that is not necessary to provide functions but serves app security or our commercial interests, for example optimisation or security analysis, is based on legitimate interests. Where users are expressly asked for consent, processing within its scope is based on that consent.

• Types of data processed: Basic personal data (for example full name, home address, contact details and customer number); usage data (page views, time spent, click paths, intensity and frequency of use, device types, operating systems and interactions with content and functions); metadata, communication data and procedural data (IP addresses, times, identification numbers and people involved).

• Data subjects: Users, such as website visitors and online service users.

• Purposes of processing: Providing contractual services and fulfilling contractual obligations; security measures; providing our online services and improving usability.

• Retention and deletion: Deletion in accordance with the section ‘General information on data retention and deletion’.

• Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

• Device permissions for access to functions and data: Use of our app or its functions may require permission to access particular device functions or data stored on or accessible through a device. Users normally grant these permissions and may withdraw them at any time in device settings. The procedure depends on the device and software. Please contact us if you need clarification. Refusing or withdrawing permissions may affect the app’s functionality.

​

Contact and enquiry management

When you contact us by post, contact form, email, phone or social media, or within existing user and business relationships, we process the information provided to the extent necessary to respond to the enquiry and any requested action.

• Types of data processed: Contact data (postal addresses, email addresses and phone numbers); content data (text or image messages and posts and related information, such as authorship and creation time); metadata, communication data and procedural data (IP addresses, times, identification numbers and people involved).

• Data subjects: Communication partners.

• Purposes of processing: Communication; organisational and administrative procedures; feedback, such as feedback collected through online forms; providing our online services and improving usability.

• Retention and deletion: Deletion in accordance with the section ‘General information on data retention and deletion’.

• Legal bases: Legitimate interests (Article 6(1), first sentence, point (f) GDPR); performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR).

Further information on processing activities, procedures and services:

• Contact form: When you contact us through a form, email or another channel, we process the personal data provided to respond to and handle your request. This usually includes your name, contact details and any other information needed to deal with it appropriately. We use this data solely for the stated contact and communication purpose. Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

 

Communication via messaging services

We use messaging services for communication. Please note the following information about their functionality, encryption, communication metadata and your options to object.

You may also contact us by alternative means, such as phone or email. Please use the contact details provided to you or listed on our website.

Where content is end-to-end encrypted, the message and its attachments, such as images, are encrypted from one end of the communication to the other. The messaging provider itself cannot read that content. Use an up-to-date version of the service with encryption enabled to ensure message content is encrypted.

However, messaging providers may know that and when you communicate with us and may process technical information about your device and, depending on device settings, location information. This is known as metadata.

Legal bases: Where we request permission before communicating through a messaging service, processing is based on consent. Where we do not request consent and you contact us on your own initiative, use in connection with contracts or their preparation is a contractual measure. For other prospective customers and communication partners, use is based on legitimate interests in fast, efficient communication and meeting their preference for messaging. We do not initially transmit contact details provided to us to messaging services without consent.

Withdrawal, objection and deletion: You may withdraw consent and object to communication through messaging services at any time. We delete messages under our general deletion rules, for example after contractual relationships end and subject to archiving requirements. Otherwise, we delete them once enquiries have been answered, no reference back to earlier conversations is expected and no statutory retention requirement prevents deletion.

Use of other communication channels: For your security, we may be unable to answer some enquiries through messaging services. This may apply where contract details are particularly confidential or a message would not meet formal requirements. In these cases we recommend a more suitable channel.

• Types of data processed: Contact data (postal addresses, email addresses and phone numbers); content data (text or image messages and posts and related authorship or creation information); usage data (page views, time spent, click paths, intensity and frequency of use, device types, operating systems and interactions with content and functions); metadata, communication data and procedural data (IP addresses, times, identification numbers and people involved).

• Data subjects: Communication partners.

• Purposes of processing: Communication; direct marketing, for example by email or post.

• Retention and deletion: Deletion in accordance with the section ‘General information on data retention and deletion’.

• Legal bases: Consent (Article 6(1), first sentence, point (a) GDPR); performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) GDPR); legitimate interests (Article 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

• Apple iMessage: Sending and receiving text and voice messages, video calls, group conversations and sharing files, photos, videos and locations; end-to-end encryption of communications and synchronisation across devices. Provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://www.apple.com/de/. Privacy policy: https://www.apple.com/legal/privacy/de-ww/.

• Instagram: Messaging through the Instagram social network. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://www.instagram.com. Privacy policy: https://privacycenter.instagram.com/policy/.

• Facebook Messenger: Sending and receiving text messages, voice and video calls, group chats, sharing files and media, transmitting location information, synchronising contacts and encrypting messages. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing. Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).

• WhatsApp: An internet communication service for sending and receiving text and voice messages, images, videos and documents, and making voice and video calls. Communication is end-to-end encrypted, so content is accessible only to the participants. The platform processes metadata, such as phone numbers, times and device information, to provide the service and may use it to improve functionality, security and services. Provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://www.whatsapp.com/; Privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea. Basis for third-country transfers: Data Privacy Framework (DPF).

​

Artificial intelligence (AI)

We use artificial intelligence (AI), involving processing of personal data. The specific purposes and our interest in its use are described below. An AI system, as defined in Article 3(1) of the AI Act, is a machine-based system designed to operate with varying levels of autonomy, which may adapt after deployment and produces outputs from inputs, such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

Our AI systems are used in compliance with applicable law, including AI-specific and data protection rules. We observe principles including lawfulness, transparency, fairness, human control, purpose limitation, data minimisation, integrity and confidentiality. Processing of personal data must have a legal basis, such as consent or statutory authorisation.

We carefully select external AI providers. In line with our legal obligations, we ensure that providers comply with applicable rules and observe our own duties when using or operating their services. Processing by us and providers is based solely on consent or a legal authorisation. We place particular importance on transparency, fairness and human control over AI-supported decision-making.

We implement appropriate, robust technical and organisational measures to protect data integrity and confidentiality and minimise potential risks. Regular reviews of AI providers and their services are intended to maintain compliance with current legal and ethical standards.

• Types of data processed: Content data, such as text or image messages and posts and related authorship or creation information; usage data, such as page views, time spent, click paths, intensity and frequency of use, device types, operating systems and interactions with content and functions.

• Data subjects: Users, such as website visitors and online service users; third parties.

• Purpose of processing: Artificial intelligence (AI).

• Retention and deletion: Deletion in accordance with the section ‘General information on data retention and deletion’.

• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR).

Further information on processing activities, procedures and services:

• ChatGPT: An AI-based service designed to understand and generate natural language and related inputs and data, analyse information and make predictions. ‘AI’ is understood in its applicable legal meaning. Provider: OpenAI Ireland Ltd, 117–126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland. Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) GDPR). Website: https://openai.com/de-DE/chatgpt/overview/; Privacy policy: https://openai.com/de-DE/policies/privacy-policy/. Opt-out: https://privacy.openai.com/policies?modal=select-subject.

​

​

​