Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Scope and roles

This privacy policy provides information on the processing of personal data on our website, in the ImmoVision platform (dashboard and mobile app) and on the exposés, microsites and virtual tours provided with the platform.

We are the controller for processing on our own website, for our customers' user accounts, for contract, billing and support, and for the security of our systems.

Real estate agencies (our customers) use the platform for their own business activities: for their prospects, customers, owners, exposés and microsites. The respective agency is the controller for this data; we process it as a processor pursuant to Art. 28 GDPR on the basis of our Data Processing Agreement (DPA). If you use an agency's exposé or microsite as a prospect, please address enquiries concerning your data primarily to that agency; its contact details are given in the legal notice of the respective page. The following sections describe the technology used there so that you can also understand this processing.

Personal data means any information relating to an identified or identifiable natural person. Processing is carried out on the basis of Art. 6(1)(a), (b), (c) and (f) GDPR; the legal basis is stated for each processing operation.

Which functions use artificial intelligence (AI), with which provider and where, is additionally described on our “AI transparency” page. For data subjects in Turkey, our “KVKK notice” applies in addition.

3. Hosting and technical provision

The website and platform are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. The database, uploaded files, generated media and backups are also stored there.

In the course of hosting, technically necessary data is processed, in particular:

• IP address,
• date and time of access,
• pages and files accessed,
• browser type, operating system and referrer URL, to the extent transmitted by the browser,
• status and error data.

The legal basis is Art. 6(1)(f) GDPR (secure, stable provision). Hetzner processes the data as a processor on the basis of a contract pursuant to Art. 28 GDPR.

4. Server logs, security logs and abuse prevention

We log security-relevant events (e.g. logins, failed login attempts, changes to permissions, exports, deletions) in order to detect attacks and misuse, analyse errors and be able to evidence operations. The audit log is protected against subsequent alteration (chained checksums).

In particular, user identifier, time, type of event, affected record and technical details are processed. The legal basis is Art. 6(1)(f) GDPR and, for statutory records, Art. 6(1)(c) GDPR.

Retention: security and login logs 2 years, logs of lead and contact operations 3 years, logs of AI and media operations 1 year; billing and consent records for as long as statutory retention and evidentiary obligations apply.

5. Cookies, local storage and similar technologies

We only use cookies and storage entries that are necessary for the function you have requested (Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)). We do not use analytics, tracking, advertising or remarketing cookies or pixels.

After you log in to the dashboard, we set a session cookie (14 days) and a device cookie (up to 400 days) which allows you to see in your account on which devices you are logged in and to log them out. The server does not set any cookies on public exposés and microsites.

Settings may be stored in your browser's local storage, e.g. language, the cookie notice, a random visitor identifier for the AI assistant (so that a conversation can be continued and a consent can be attributed) and – only if you choose it – the setting “Remember on this device” for the map. The complete list with names and durations can be found on our “Cookies & storage technologies” page.

Further processing is carried out on the basis of Art. 6(1)(b) GDPR (provision of the function) or Art. 6(1)(f) GDPR (security).

6. Note on payments via Stripe

If you access a payment process, a credit top-up, a checkout or embedded payment elements from Stripe, Stripe may use its own cookies and similar technologies in connection with its services to the extent necessary for payment processing, authentication, fraud prevention, security and the provision of the Stripe services. Stripe describes this in its Cookie Policy and its Privacy Policy.

This processing relates to the specific payment process accessed. Beyond this, we currently do not use any marketing or analytics cookies on our general website.

7. Language settings / internationalisation

If our website or platform supports several languages, we may store the language or regional display you have chosen in order to restore the desired display on a subsequent visit.

Processing is carried out on the basis of Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. To the extent that technically necessary access to your terminal device or technically necessary storage is required for this, this takes place within the framework of Section 25(2) TDDDG.

8. Fonts and libraries from our own source

We deliver fonts and program libraries (e.g. for the map display) from our own servers. Therefore, no connection to third-party font or CDN services is established when a page is accessed.

9. Own media content and self-hosted videos

Our pages may include our own images, graphics, MP4 files and other media content that we host ourselves or deliver via our own infrastructure.

When such content is retrieved, technically necessary connection and delivery data is processed. Processing is carried out on the basis of Art. 6(1)(f) GDPR.

10. Contacting us in general

If you contact us via a contact form, e-mail, telephone or by other means, we process the data you provide in order to handle your enquiry and to contact you.

In particular, the following may be processed:

• name,
• e-mail address,
• telephone number,
• company name,
• content of your message,
• reference to a property or service,
• technical metadata in connection with the transmission.

Processing is carried out on the basis of Art. 6(1)(b) GDPR insofar as your enquiry is aimed at the conclusion of a contract or at pre-contractual measures. In other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR.

Your data will be deleted as soon as your enquiry has been conclusively dealt with and no statutory retention obligations or legitimate evidentiary interests prevent this.

11. Website contact form

If you use our website contact form, we process the data you enter in order to handle your enquiry, answer follow-up questions and get in touch with you.

Mandatory fields in forms are marked as such. Without this information, your enquiry may not be able to be processed.

12. Enquiries via exposés, microsites and virtual tours

On an agency's exposés and microsites, you can send property enquiries, viewing or appointment requests, search requests, owner enquiries or valuation requests. The respective agency is the controller; we process the data on its behalf.

The information you enter (e.g. name, e-mail, telephone, message, search criteria, requested appointment) is processed, together with the assignment to the property and to the responsible contact person. Your consent or confirmation is stored as evidence together with the wording and time; your IP address and your browser are not stored in the process.

For page statistics of the microsites (e.g. views, clicks), we do not store an IP address or browser, but only a check value that changes daily and cannot be reversed; this statistical data is deleted after 90 days. Search requests are deleted 180 days after the last activity.

The legal basis is Art. 6(1)(b) GDPR (enquiry, initiation of a contract), for statistics Art. 6(1)(f) GDPR, and for consent-based functions Art. 6(1)(a) GDPR.

13. Appointment booking / calendar functions

If you request or book appointments via our website, exposés, microsites or the system, we process your data for arranging, confirming, rescheduling and organising appointments.

In particular, the following data may be processed:

• name,
• e-mail address,
• telephone number,
• requested appointment,
• reference to a property or case,
• notes or details of the matter,
• status data for appointment management.

Processing is carried out on the basis of Art. 6(1)(b) GDPR.

14. User accounts, login and security

For users of the platform, we process the data required to set up and use the account:

• name, e-mail address, telephone number (optional), profile picture (optional),
• role, permissions, agency and team assignment,
• password exclusively as a hash,
• two-factor login (code by e-mail or authenticator app; the secret is stored encrypted),
• logged-in devices (device name, last use) and session data,
• personal settings (language, view, notifications, AI functions on/off).

Sessions end after 14 days; devices that have not been used for 90 days are logged out automatically. If an account is blocked or permissions are changed, existing sessions end immediately.

The legal basis is Art. 6(1)(b) GDPR and, for security measures, Art. 6(1)(f) GDPR.

15. CRM, lead management and internal case handling

In the course of the use of our platform, we process personal data for the management, structuring and handling of leads, customer enquiries, cases, tasks and communication histories.

This may include in particular:

• master data and contact data,
• property reference and interest data,
• communication histories,
• internal processing notes,
• responsibilities, status and tasks,
• notes, appointment reference and process data.

Processing is carried out on the basis of Art. 6(1)(b) GDPR insofar as this is necessary for the initiation or performance of a contract, and additionally on the basis of Art. 6(1)(f) GDPR for internal organisational and administrative purposes.

Agents' personal notes are visible only to the respective person (not even to the agency management). Deleted notes are permanently deleted after 30 days in the recycle bin.

16. Internal lead statistics and internal system evaluations

Insofar as we compile internal reach, enquiry, lead, usage or process statistics, this is generally done for internal management, quality assurance, capacity planning, abuse prevention, traceability of billing and optimisation of our processes.

Insofar as this is done purely on the server side, internally and without tracking technologies on the public website that require consent, we base the processing on Art. 6(1)(f) GDPR. Our legitimate interest lies in the economic, technical and organisational management of our offering.

According to our system concept, there is currently no public website web analytics for marketing, remarketing or profile-based advertising purposes.

To improve the user interface, we merely count, per agency and per day, how often certain views are used — without reference to individuals and without content; these counters are deleted after 400 days.

17. AI functions

ImmoVision uses AI for texts and translations, image editing and virtual staging, videos, dictation and voice commands, transcription and summarisation of conversations, market analyses and for assistants on exposés, microsites and in the dashboard. An overview per function is provided on the “AI transparency” page.

The main provider is Google Cloud (Vertex AI, Gemini and Veo models), contractual partner Google Cloud EMEA Limited, Ireland. Processing takes place in data centres in the European Union (EU region, Frankfurt, Netherlands). In addition, Microsoft Azure OpenAI (Microsoft Ireland Operations Limited) may be used in an EU region. Both providers act as processors.

Only the content required for the respective function is transmitted to the AI provider, e.g. text input, property details, images, audio recordings or conversation content. In the WhatsApp assistant, e-mail addresses, telephone numbers and account numbers are replaced by placeholders before transmission.

Under the contractual terms of the providers used, your data is not used to train their AI models. We do not train any AI models with customer data either. The providers may temporarily cache inputs or review them for abuse detection in accordance with their terms.

Dictations, voice commands and live conversations with the personal assistant are not stored as audio; only the result that you accept is stored. Results of AI functions are reviewed by a human before use; AI-generated or AI-modified images and videos are labelled (see “AI transparency”). To answer, the personal assistant (“Sintrii”) reads data from ImmoVision only within the viewing rights of the respective person, including lead contact details; processing takes place at Google in the EU as a processor.

The legal basis is Art. 6(1)(b) GDPR (requested function) and additionally Art. 6(1)(f) GDPR. Special categories of personal data (Art. 9 GDPR) are not intended to be processed via AI functions.

18. Video creation

For property and social media videos, Google Veo (Vertex AI, EU region) generates video clips from property photos. The videos are assembled on our own servers or via the rendering service Shotstack (Shotstack Pty Ltd, Australia). The images, clips and texts selected for the video are transmitted to Shotstack — as a rule, no data of prospects. Australia is a third country; the transfer is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Finished videos are stored in the agency's account for as long as the property exists or until the agency deletes them. Videos contain a visible notice of AI generation.

The legal basis is Art. 6(1)(b) GDPR.

19. Image editing, virtual staging and AI image record

Images can be edited with AI (e.g. virtual furnishing, renovation preview, image enhancement). The source image, your instructions and the result are processed via Google Vertex AI (EU region).

Recognisable faces are made unrecognisable before processing where the function provides for this. AI-modified images are labelled visibly and in the image data (metadata). If an AI image is used in a listing, we store as evidence the original image, the AI image, the tool and instruction, the confirmation of the responsible person and the publication channels; the original and the AI image are not deleted automatically for as long as this record exists.

The legal basis is Art. 6(1)(b) GDPR; for the record, Art. 6(1)(c) and (f) GDPR (labelling and fair-trading obligations).

20. Call recording, transcription and voice notes

Agencies can record telephone calls via the telephony providers Twilio (Twilio Ireland Limited) or Voximplant and have them evaluated with AI. A recording only begins after the other party has expressly agreed following an announcement; without consent, no recording is made. The consent is stored together with the time.

Recordings are transcribed and summarised via Google Vertex AI (EU region). The agency determines the retention period of the recordings (30, 90, 180 or 365 days or without a time limit; default 30 days); once the period expires, they are deleted.

Voice notes and dictations are also evaluated via Google Vertex AI; in the case of customer conversations, only with the consent of the other parties. Audio is not stored after evaluation.

The agency is responsible for the lawfulness of a recording. The legal basis is Art. 6(1)(a) GDPR (consent) or, for the agent's voice notes, Art. 6(1)(b) GDPR.

20.1 AI assistant on exposés and microsites (chat and voice)

Agencies can offer an AI assistant on exposés and microsites that answers questions about the property and can suggest appointments. It expressly points out that you are talking to an AI. A conversation only begins after your consent; the wording and time are stored as evidence.

Your messages or your voice, the answers, a random visitor identifier and – if you provide them – your contact details for an enquiry or appointment are processed. Voice is processed in real time via Google Vertex AI (Gemini Live, Netherlands region) and is not stored as audio. Conversation histories are deleted after 90 days.

You can withdraw your consent at any time in the assistant; the conversation history and summaries are then deleted. Enquiries already submitted remain with the agency. The legal basis is Art. 6(1)(a) GDPR and, for enquiries and appointments, Art. 6(1)(b) GDPR.

20.2 WhatsApp, Instagram and Messenger

Agencies can connect WhatsApp Business, Instagram and Facebook Messenger accounts as well as Meta lead forms. Messages are transmitted via the interfaces of Meta Platforms Ireland Limited (for WhatsApp, also via Twilio). In doing so, Meta also processes data under its own responsibility in accordance with its terms.

An AI assistant can answer WhatsApp messages; it begins its first answer with the notice that it is an AI and pauses as soon as an employee responds. The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

20.3 E-mail sending, mailbox and calendar connection

We send system e-mails (e.g. confirmations, notifications) via our own mail server. E-mails from agents to their customers are sent via the agent's Microsoft 365 or Google mailbox if the agent has connected it; calendars can likewise be synchronised. If the agent switches on “Contacts from Outlook”, ImmoVision reads their Microsoft address book read-only (name, phone, email, company; no notes or birthdays); only contacts the agent selects are imported, they are visible only to the agent and are then updated in one direction. ImmoVision never writes to the address book. Processing by the mailbox or calendar provider is carried out on the basis of the contract between the agency and that provider. If the agent has also switched on inbox reading, ImmoVision classifies incoming emails: enquiries from property portals and emails from existing clients are stored with the respective lead; for unknown senders only a short excerpt (at most 400 characters) is shown as a suggestion and deleted after 48 hours. Newsletters, promotions, notifications and automatic replies are not read.

The legal basis is Art. 6(1)(b) GDPR.

20.4 Push notifications

On exposés and microsites, you can subscribe to notifications (e.g. new matching properties); users of the platform can receive notifications on their devices. For this purpose, we store the subscription address generated by the browser and your consent (wording, time). Delivery takes place in encrypted form via the push service of your browser manufacturer (e.g. Google, Mozilla, Apple, Microsoft).

You can unsubscribe from notifications at any time on the page or in your browser. The legal basis is Art. 6(1)(a) GDPR.

20.5 Maps

In the exposé, a Google map (Google Ireland Limited) is only displayed once you expressly click on it. Only then is a connection to Google established and your IP address transmitted. Your decision is stored as evidence with a random identifier (without IP address); if you wish, your browser remembers the approval. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

When the map picker is opened (e.g. in the property valuation on microsites or when entering a property), map tiles and the address search are loaded from OpenStreetMap (OpenStreetMap Foundation, United Kingdom); in the process, your IP address is transmitted to OpenStreetMap. An adequacy decision of the EU Commission exists for the United Kingdom. The legal basis is Art. 6(1)(f) GDPR (map function requested by you).

For location analyses, we query public map data (OpenStreetMap's Overpass API) exclusively with the coordinates of the property, not with personal data.

20.6 Integrations at the agency's instigation

Agencies can connect further services, e.g. CRM and real estate agent software (HubSpot, Propstack, onOffice), property portals, the Turkish register for commercial electronic communications (İYS), e-invoicing providers and webhooks. Data is only transmitted to these services if the agency sets up the connection; processing by the respective service is governed by the contract between the agency and the service.

A 360° tour may be embedded from an external provider chosen by the agency; when it is accessed, that provider's privacy notices apply.

21. Payment processing, credit, billing and online payments

If you take out a subscription, top up credit or use other paid services, we process your data for contract performance, payment processing, accounting, credit management and traceability of usage.

In particular, the following data may be processed:

• name,
• billing address,
• e-mail address,
• contract and service information,
• credit balance,
• top-ups,
• payment status,
• billing events,
• wallet movements,
• transaction and invoice data,
• tax-relevant information.

The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR insofar as statutory retention and evidentiary obligations exist.

21.1 Use of Stripe

We may use Stripe for payment processing. In the course of payment processing, Stripe may in particular process payment, transaction, identification, fraud prevention and technical device data. Stripe also points out that cookies and similar technologies may be used in connection with its services and that personal data may be processed to carry out transactions, prevent fraud, authenticate and analyse the performance of the Stripe services.

Stripe may process personal data partly as a processor and partly as an independent controller, in particular for fraud prevention, avoidance of financial losses, security purposes and the provision of the Stripe services.

22. Recipients / categories of recipients

We only disclose personal data insofar as this is necessary for the purposes stated or a legal obligation exists. Recipients are:

• Hetzner Online GmbH (hosting, Germany),
• Google Cloud EMEA Limited (AI functions via Vertex AI, EU regions),
• Microsoft Ireland Operations Limited (Azure OpenAI, EU region), where used,
• Shotstack Pty Ltd (video rendering, Australia),
• Twilio Ireland Limited and Voximplant (telephony, recording, WhatsApp transmission), where set up by the agency,
• Meta Platforms Ireland Limited (WhatsApp, Instagram, Messenger, lead forms), where set up by the agency,
• Stripe Payments Europe Limited (payment processing),
• push services of browser manufacturers, Google (map after your approval), OpenStreetMap Foundation (map picker),
• services connected by the agency (mailbox, calendar, CRM, portals, İYS, e-invoicing),
• tax advisers, authorities and courts, where required by law.

The complete list of sub-processors with purpose and location is available on the “Sub-processors” page.

23. Transfers to third countries

AI, hosting and storage take place in the EU. A transfer to countries outside the EU/EEA only takes place insofar as a basis pursuant to Art. 44 et seq. GDPR exists:

• USA (e.g. Google LLC, Microsoft Corporation, Meta Platforms Inc., Twilio Inc., Stripe Inc. as group companies or sub-processors): adequacy decision on the EU-U.S. Data Privacy Framework for certified companies, supplemented by EU Standard Contractual Clauses,
• Australia (Shotstack): EU Standard Contractual Clauses,
• United Kingdom (OpenStreetMap Foundation): adequacy decision.

For data subjects in Turkey, processing in the EU constitutes a transfer abroad pursuant to Art. 9 KVKK; details are set out in our KVKK notice.

24. Retention period

We store personal data only for as long as is necessary for the respective purpose or statutory retention obligations exist. In detail:

• sessions 14 days; unused devices are logged out after 90 days,
• microsite statistics 90 days; search requests 180 days after the last activity,
• conversation histories of the AI assistant 90 days,
• call recordings as specified by the agency (default 30 days),
• notes in the recycle bin 30 days,
• agency data exports 24 hours,
• security logs 2 years, lead and contact logs 3 years, AI and media logs 1 year,
• an agency's leads, contacts, properties, media and documents until deletion by the agency or until the end of the contract (return/deletion in accordance with the DPA),
• AI image records (original, AI image, confirmation, publications) until a period for the record has been determined; they are not deleted automatically,
• commercial and tax documents (e.g. invoices, accounting vouchers) 6, 8 or 10 years in accordance with Section 257 German Commercial Code (HGB) and Section 147 German Fiscal Code (AO),
• consent records for as long as the consent is used and claims arising from it can be asserted.

25. Legal bases for processing

Unless otherwise stated in this privacy policy, we process personal data on the basis of the following legal bases:

• Art. 6(1)(a) GDPR – consent,
• Art. 6(1)(b) GDPR – contract / pre-contractual measures,
• Art. 6(1)(c) GDPR – legal obligation,
• Art. 6(1)(f) GDPR – legitimate interests.

Section 25(2) no. 2 TDDDG applies to technically necessary access to terminal devices, and Section 25(1) TDDDG applies to consent-based access (e.g. remembering the Google map).

26. Automated decision-making / profiling

No decision based solely on automated processing within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you takes place.

AI functions and property matching generate suggestions, summaries and rankings that support agents in their work. Decisions on offers, appointments and contracts are made by humans.

27. Your rights

Under the GDPR, you have in particular the following rights:

• right of access,
• right to rectification,
• right to erasure,
• right to restriction of processing,
• right to data portability,
• right to object to processing based on Art. 6(1)(f) GDPR,
• right to withdraw consent given at any time with effect for the future,
• right to lodge a complaint with a data protection supervisory authority.

28. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority.

For controllers established in Schleswig-Holstein, the competent authority is generally the Independent Centre for Data Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein).

Data subjects in Turkey may also contact the Turkish data protection authority (Kişisel Verileri Koruma Kurumu).

29. Obligation to provide data

The provision of personal data is not generally required by law or contract. For certain functions, however, the provision of the necessary data is required so that we can handle your enquiry, organise an appointment, perform a contract, provide a user account, manage credit or provide a requested function.

Without the respectively required information, certain services may not be provided or contracts may not be concluded.

30. Data security

We take technical and organisational measures pursuant to Art. 32 GDPR, in particular:

• encrypted transmission (TLS) and encrypted storage of access credentials and third-party keys,
• two-factor login, device control and immediate termination of sessions upon blocking,
• tenant separation and role-based visibility (e.g. agents only see their own leads if the agency configures this),
• time-limited, signed links for private files,
• audit log with chained checksums,
• quarantine instead of immediate deletion of files, and regular backups,
• on/off switches for AI functions per agency and per person.

31. Changes to this privacy policy

We reserve the right to amend this privacy policy if legal requirements, technical processes or our services change. The current version published on this website applies in each case.