3.1. Notice for website visitors from Germany
Our website stores information in the terminal equipment of website visitors (e.g. cookies) or accesses information that is already stored in the terminal equipment (e.g. IP addresses). What information this is in detail can be found in the following sections.
This storage and access is based on the following provisions:
- Insofar as this storage or access is absolutely necessary for us to provide the service of our website expressly requested by website visitors (e.g., to carry out a chatbot used by the website visitor or to ensure the IT security of our website), it is carried out on the basis of Section 25 para. 2 no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutzgesetz, "TDDDG").
- Otherwise, this storage or access takes place on the basis of the website visitor's consent (Section 25 para. 1 TDDDG).
The subsequent data processing is carried out in accordance with the following sections and on the basis of the provisions of the GDPR.
3.2. Informative use of our website
During the informative use of the website, i.e. when site visitors do not separately transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so that the legal basis is Art. 6 para. 1 s. 1 lit. f GDPR.
These data are:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request comes
- Browser
- Operating system and its interface
- Language and version of the browser software
This data is also stored in log files. They are deleted when their storage is no longer necessary, at the latest after 30 days.
3.3. Web hosting and provision of the website
Our website is hosted by Google Cloud. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Dublin, Ireland. In doing so, the provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication data or contact data, in the EU. Further information can be found in the provider's privacy policy at https://business.safety.google/privacy/.
It is our legitimate interest to provide a website, so the legal basis of the described data processing is Art. 6 para. 1 s. 1 lit. f GDPR.
We use the content delivery network Cloudflare for our website. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The provider thereby processes the personal data transmitted via the website, e.g. content, usage, meta/communication data or contact data in the USA. Further information can be found in the provider's privacy policy at https://www.cloudflare.com/de-de/privacypolicy/.
We have a legitimate interest in using sufficient storage and delivery capacity to ensure optimal data throughput even during large peak loads. Therefore, the legal basis of the described data processing is Art. 6 para. 1 s. 1 lit. f GDPR.
Legal basis of the transfer to a country outside the EEA is an adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
3.4. Contact form
When contacting us via the contact form on our website, we store the data requested there and the content of the message. The legal basis for the processing is our legitimate interest in answering inquiries directed to us. The legal basis for the processing is therefore Art. 6 para. 1 s. 1 lit. f GDPR. We delete the data accruing in this context after the storage is no longer necessary or restrict the processing if there are legal retention obligations.
3.5. Vacant positions
We publish vacant positions on our website, on pages linked to the website or on third-party websites.
The processing of the data provided as part of the application is carried out for the purpose of implementing the application process. Insofar as this is necessary for our decision to establish an employment relationship, the legal basis is Art. 88 para. 1 GDPR in conjunction with Sec. 26 para. 1 of the German Data Protection Act (Bundesdatenschutzgesetz). We have marked the data required to carry out the application process accordingly or refer to them. If applicants do not provide this data, we cannot process the application. Further data is voluntary and not required for an application. If applicants provide further information, the basis is their consent (Art. 6 para. 1 s. 1 lit. a GDPR).
We ask applicants to refrain from providing information on political opinions, religious beliefs and similarly sensitive data in their CV and cover letter. They are not required for an application. If applicants nevertheless provide such information, we cannot prevent their processing as part of the processing of the resume or cover letter. Their processing is then also based on the consent of the applicants (Art. 9 para. 2 lit. a GDPR).
Finally, we process the applicants' data for further application procedures if they have given us their consent to do so. In this case, the legal basis is Art. 6 para. 1 s. 1 lit. a GDPR.
We pass on the applicants' data to the responsible employees in the HR department, to our data processors in the area of recruiting and to the employees otherwise involved in the application process.
If we enter into an employment relationship with the applicant following the application process, we delete the data only after the employment relationship has ended. Otherwise, we delete the data no later than six months after rejecting an applicant.
If applicants have given us their consent to use their data for further application procedures as well, we will not delete their data until one year after receiving the application.
3.6. Booking of appointments
Site visitors can book appointments with us on our website. For this purpose, we process meta data or communication data in addition to the data entered. We have a legitimate interest in offering interested parties a user-friendly option for making appointments. Therefore, the legal basis for data processing is Art. 6 para. 1 s. 1 lit. f GDPR. Insofar as we use a third-party tool for the agreement, the information on this can be found under "Third parties".
3.7. Customer account
Site visitors can open a customer account on our website. We process the data requested in this context to fulfill the respective user contract concluded for the account, so that the legal basis for the processing is Art. 6 para. 1 s. 1 lit. b GDPR.
3.8. Offer of services
As part of the services offered on our website, we process a variety of personal data in order to handle your enquiries and provide our agency services. This includes, in particular:
- Identification data (name, date of birth, nationality, gender)
- Contact details (address, email address, telephone number)
- Family and household information (marital status, number of children)
- Employment data (employer, position, contract details, employment status)
- Income and tax data (income level, tax bracket)
- Financial data (existing loans, liabilities, bank details)
- Financing requirements and preferences (loan amount, term, repayment preferences)
- Property-related data (property address, property features, purchase price)
- Documents provided by the customer (copies of ID, proof of income, bank statements, employment confirmations, property documents)
This data is processed in accordance with Art. 6 (1) (b) GDPR for the purpose of implementing pre-contractual measures and fulfilling the contract concluded with you. We use specialised service providers for the technical processing of the order process and the secure shipping and transmission of your data. In this context, we pass on the aforementioned data to the following platforms to the extent necessary for processing your order:
- EUROPACE AG, Heidestraße 8, 10557 Berlin
- Prohyp GmbH, Domagkstraße 34, 80807 Munich
- Qualitypool GmbH, Hansestraße 14, 23558 Lübeck
The legal basis for the use of these service providers and the associated data transfer is also Art. 6 (1) (b) GDPR, as the use of these systems is necessary for the efficient execution of the order process and the fulfilment of our contractual obligations towards you.
3.8.1. Cooperation with financing platforms (EUROPACE and Prohyp)
To perform our brokerage services, we use the technological marketplaces of EUROPACE AG, Heidestraße 8, 10557 Berlin, and Prohyp GmbH, Domagkstraße 34, 80807 Munich. These platforms enable us to compare the terms and conditions of numerous lenders using a computerised system. As part of this cooperation, the personal data referred to in section 3.8 is transferred to these platform operators in order to create financing enquiries and handle communication with potential lenders (banks, savings banks, insurance companies). The platform operators process this data as processors or as independent controllers in order to forward the enquiries to the respective institutions for creditworthiness checks. The legal basis for this data transfer is Art. 6 (1) (b) GDPR, as the use of these marketplaces is necessary for the efficient implementation of pre-contractual measures and for the fulfilment of our contractual brokerage obligations towards you.
3.8.2. Involvement of broker pools (Qualitypool)
In addition to using the aforementioned marketplaces, we involve Qualitypool GmbH, Hansestraße 14, 23558 Lübeck, in the brokerage process. The provider supports us in the technical preparation of your documents and in the quality control of the documents required for the loan application. In this context, the data categories listed in section 3.8 are transferred to Qualitypool GmbH in order to ensure the proper submission of the financing application to the respective lenders. The legal basis for this processing is Art. 6 (1) (b) GDPR, as the involvement of this service provider is necessary for the efficient execution of the brokerage process and the review of the mortgage documents.
3.9. Technically necessary cookies
Our website sets cookies. Cookies are small text files that are stored in the web browser on the end device of a site visitor. Cookies help to make the offer more user-friendly, effective and secure. Insofar as these cookies are necessary for the operation of our website or its functions (hereinafter "Technically Necessary Cookies"), the legal basis for the associated data processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in providing customers and other site visitors with a functional website. Specifically, we set technically necessary cookies for the following purposes:
- to save login data
- to apply language settings
3.10. Recording and transcription of telephone calls
When you contact us by telephone, we use technologies for documentation and analysis. We record the spoken word and use algorithms to create automated text transcripts of the conversation. For this purpose, we use functions provided by HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin. The processing serves to fulfil our legal documentation obligations as a real estate loan broker and for quality assurance purposes. The legal basis for the recording and transcription is your express consent in accordance with Art. 6 (1) (a) GDPR. Before recording begins, you will be informed of this process by an announcement. By continuing the conversation after this announcement, you declare your consent to the recording. If you do not wish to be recorded, please end the conversation after the announcement. You can revoke your consent at any time with effect for the future.
3.11. Data processing under professional secrecy (§ 34i GewO)
As a licensed real estate loan broker in accordance with § 34i GewO, we process data that is subject to special confidentiality. All data categories mentioned in section 3.8, in particular identification, income and financial data, are processed in accordance with professional secrecy. Data is only passed on to the partners mentioned in section 3.8 (EUROPACE, Prohyp, Qualitypool) for the specific purpose of providing the contractually agreed brokerage services. The legal basis for this processing is the fulfilment of the contract concluded with you in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR.
3.12. Third parties
3.12.1. HubSpot
We use HubSpot for analytics, for marketing automation, to generate leads. The provider is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin. The provider processes usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), content data (e.g. entries in online forms) in the EU.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in managing data in a simple and inexpensive way.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at https://legal.hubspot.com/privacy-policy.
3.12.2. Google Search Console
We use Google Search Console to analyse and technically optimise our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. search queries, click rates) and meta/communication data (e.g. IP addresses) in the USA.
The legal basis for processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in analysing the visibility of our website in search engines and in correcting technical errors in order to improve the user experience and security.
The transfer of personal data to a country outside the EEA is based on the legal basis of the adequacy decision (EU-U.S. Data Privacy Framework). The security of the data transferred to the third country is guaranteed because the EU Commission has decided that the third country offers an adequate level of protection.
The data will be deleted when the purpose for which it was collected no longer applies and there are no retention obligations. Further information is available in the provider's privacy policy at https://policies.google.com/privacy.
3.12.3. Google Analytics
We use Google Analytics for analytics. The provider is Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The provider processes usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses) in the USA.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.
The transfer of personal data to a country outside the EEA takes place on the legal basis adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.
3.12.4. Google Tag Manager
We use Google Tag Manager for advertising, for analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times) in the USA.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.
The transfer of personal data to a country outside the EEA takes place on the legal basis adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
We delete the data when the purpose for which it was collected no longer applies. Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.
3.12.5. Meta Pixel
We use Meta Pixel for analytics. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times) in the USA.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.
The transfer of personal data to a country outside the EEA takes place on the legal basis adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at https://www.facebook.com/policy.php.
3.12.6. Google Ads
We use Google Ads for advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses) in the USA.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.
The transfer of personal data to a country outside the EEA takes place on the legal basis adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
We delete the data when the purpose for which it was collected no longer applies. Further information is available in the provider's privacy policy at https://business.safety.google/privacy/.
3.12.7. WhatsApp Business
We use WhatsApp Business for communication. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times), content data (e.g. entries in online forms), contact data (e.g. e-mail addresses, telephone numbers), meta/communication data (e.g. device information, IP addresses), master data (e.g. names, addresses) in the USA.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in ensuring that communication within our company is effective.
The transfer of personal data to a country outside the EEA takes place on the legal basis adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at https://www.whatsapp.com/legal/updates/privacy-policy-eea?lang=en.
3.12.8. heyData
We have integrated a data protection seal on our website. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (e.g. IP addresses) in the EU.
The legal basis of the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in providing website visitors with confirmation of our data privacy compliance. At the same time, the provider has a legitimate interest in ensuring that only customers with existing contracts use its seals, which is why a mere image copy of the certificate is not a viable alternative as confirmation.
As the data is masked after collection, there is no possibility to identify website visitors. Further information is available in the privacy policy of the provider at https://heydata.eu/en/privacy-policy.