1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
BATU IMMOBILIEN · Owner Batu Karaoguz
Walldorfer Weg 32, 64546 Mörfelden-Walldorf
Phone: +49 6105 30 80 837 · Email: info@batu-immobilien.de
No data protection officer has been appointed, as the statutory requirements for doing so are not met.
2. General information on data processing
Personal data is only processed insofar as this is necessary to provide a functional website and to deliver the services offered, or where consent has been given.
Legal bases
- Art. 6(1)(a) GDPR — consent (e.g. cookies, audience measurement, map and social media embeds)
- Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures (e.g. property enquiries, brokerage agreement)
- Art. 6(1)(c) GDPR — legal obligation (e.g. Money Laundering Act, commercial and tax law)
- Art. 6(1)(f) GDPR — legitimate interest (e.g. technical operation and security of the website)
3. Hosting
The website is hosted by an external service provider (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA). The data generated when the website is visited is processed on the provider's servers.
Hosting serves the secure, fast and reliable provision of our online services and is based on Art. 6(1)(f) GDPR. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider.
As the provider is based in the USA, personal data may be transferred to a third country. The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, insofar as the provider is certified accordingly, and otherwise on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
4. Server log files
When the website is accessed, information transmitted by the browser is automatically collected:
- page accessed and date and time of access
- amount of data transferred and notification of successful retrieval
- browser type and browser version, operating system used
- referrer URL and IP address
Processing is carried out on the basis of Art. 6(1)(f) GDPR for the purposes of technical operation, error analysis and defence against attacks. This data is not merged with other data sources. The log files are deleted after 30 days at the latest, unless they are required to investigate a specific security incident.
5. Contact form and contacting us
In the case of an enquiry via the contact form, by email, by phone or via WhatsApp, the details provided are stored for the purpose of processing the enquiry and in case of follow-up questions.
The legal basis is Art. 6(1)(b) GDPR insofar as the enquiry is aimed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR on the basis of the legitimate interest in responding to enquiries.
The data is deleted as soon as the enquiry has been conclusively dealt with and no statutory retention obligations prevent this.
6. Property enquiries and transfer to owners
The property enquiry function can be used to enquire about specific property listings. The data provided in the process is processed, in particular name, contact details and details of the reason for the enquiry, as well as the property enquired about.
To process the enquiry, the data is transferred to the extent necessary to the owner of the property enquired about and, where applicable, to the notary performing the notarisation. The legal basis is Art. 6(1)(b) GDPR.
Data of prospective buyers or tenants who do not enter into a contractual relationship are deleted no later than upon completion of the marketing of the property concerned, unless further consent to inclusion in the prospect register has been given.
6a. Online brokerage agreement and electronic withdrawal
If you conclude a brokerage agreement via the website or declare withdrawal using the “Withdraw from contract” function, the details you enter are processed: name, address, email address, telephone number where applicable, and the reference to the contract or property.
In addition, the declarations made are stored with date and time, together with the version of the contract documents displayed and the time of dispatch and recipient address of the confirmation. The purpose is the conclusion of the contract, the transmission of the contract documents on a durable medium and proof of the declarations made.
For enquiries, contract conclusions and withdrawals via the website, we also store the page from which the declaration was made and the browser identifier (user agent: browser type and version, operating system). It forms part of the proof of how and from which type of device the declaration was made. Your IP address is not stored in this process.
The legal basis is Art. 6(1)(b) GDPR and, insofar as statutory obligations to provide proof and retain records exist, Art. 6(1)(c) GDPR. The data are deleted as soon as they are no longer required for these purposes and no retention obligations preclude deletion: at the latest after the statutory periods have expired – business letters and brokerage agreements 6 years, invoices and accounting records 10 years (Section 257 HGB, Section 147 AO), enquiries without a contract after the regular limitation period of 3 years (Section 195 BGB).
6b. Personal access to property documents
If you enquire about a specific property via the website, you will receive a personal link to the property documents by email (for example the exposé, energy performance certificate and floor plans). We release further documents only after a personal conversation. Documents containing personal data of third parties – such as land register extracts, minutes of owners’ meetings or tenancy agreements – are provided in redacted form only.
For this purpose we process the details from your enquiry (name, email address and, where applicable, telephone number and address), the property enquired about, a randomly generated access key with its validity (30 days, extendable) and a log with the date and time of each visit to the documents page and each download, including the browser identifier (user agent). We do not store your IP address in this process.
When downloaded, PDF documents are marked with your name, the time of retrieval and a note that they may only be passed on with our consent. The purpose is to provide you with the documents, to protect the owners’ confidential documents against unauthorised disclosure and to be able to prove which documents were provided and when.
The legal basis is Art. 6(1)(b) GDPR (processing your enquiry, pre-contractual measures) and Art. 6(1)(f) GDPR; our legitimate interest lies in protecting confidential documents and in proving our brokerage activity. Documents and access data are stored with Vercel Inc. (see section 3) and Upstash Inc. (database, server location: Frankfurt am Main, EU); a data processing agreement pursuant to Art. 28 GDPR is in place with both.
We can block your access at any time; on request we will block it immediately. Access data and the log are deleted as soon as the marketing of the property has been completed and no retention obligations preclude deletion: at the latest after the statutory periods have expired – business letters and brokerage agreements 6 years, invoices and accounting records 10 years (Section 257 HGB, Section 147 AO), enquiries without a contract after the regular limitation period of 3 years (Section 195 BGB).
6c. Search profile with e-mail alerts
If you submit a search request via the website, we send you an e-mail with a confirmation link. Your search profile only becomes active once you click it and confirm (double opt-in). We then inform you by e-mail as soon as we list a new property that matches your criteria.
For this we process your name, e-mail address, search criteria (buy or rent, property type, location or region, budget, number of rooms), language, the time of registration and confirmation, and which listings we have already sent you.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future – via the unsubscribe link in every e-mail or by sending us a message. When you unsubscribe, we delete your search profile. Unconfirmed search profiles are deleted after 7 days. The data is stored with Upstash Inc. (database, server location: Frankfurt am Main, EU); e-mails are sent via our e-mail provider. Data processing agreements pursuant to Art. 28 GDPR are in place with these service providers.
7. Statutory retention obligations
If a contract is concluded, the controller, as a real estate agent, is subject to special statutory obligations:
- Under the German Money Laundering Act (GwG), contracting parties must be identified; the data collected and copies of identity documents must be retained for five years (§ 8 GwG).
- Under commercial and tax law, retention periods of six and ten years respectively apply (§ 257 HGB, § 147 AO).
The legal basis is Art. 6(1)(c) GDPR. During the retention period, the data are blocked for other purposes.
8. Cookies and consent
The website uses cookies and comparable technologies. Technically necessary cookies that are required to operate the website are used on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR.
All other cookies and embedded services — in particular for audience measurement as well as map and social media services — are only set after express consent via the consent banner. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
Consent is voluntary and may be withdrawn at any time with effect for the future via the “Cookie settings” link in the footer of every page. The lawfulness of processing carried out until withdrawal remains unaffected.
Categories
- Necessary – operation of the website and storage of your selection (always active)
- Statistics – Google Analytics (Section 9)
- Marketing – Meta Pixel (Section 9a)
- External media – Google Maps (Section 10)
Storage of your selection
Your selection is stored in your browser's local storage (localStorage, entry “batu_consent”) together with the date and version. This information is not transmitted to us or to third parties; no external consent service is used. After 6 months, or if the services used change, we will ask for your selection again. The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent).
9. Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).
Google Analytics enables an analysis of usage behaviour. Among other things, the sequence of page views, the length of visits, the source of visits, the device used and the approximate location are recorded and evaluated under a pseudonym. Cookies and similar recognition technologies are used for recognition purposes.
The IP address is shortened before being stored and is not merged with other Google data. The controller cannot identify individual visitors on the basis of the analyses.
Legal basis and withdrawal
It is used exclusively after consent has been given in advance. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. Without consent, Google Analytics is not loaded.
Consent may be withdrawn at any time with effect for the future via “Cookie settings” in the footer. In addition, data collection can be prevented using Google's browser add-on: https://tools.google.com/dlpage/gaoptout
Data processing on behalf of the controller and transfers to third countries
A data processing agreement pursuant to Art. 28 GDPR is in place with Google. A transfer of personal data to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the EU Commission of 10 July 2023 and, additionally, on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
Storage period
The data stored at user and event level are automatically deleted after 14 months. Aggregated, non-personal analyses are retained beyond that.
Further information on how Google handles user data: https://policies.google.com/privacy
9a. Meta Pixel
With your consent, this website uses the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (“Meta”). This allows us to measure how effective our ads on Facebook and Instagram are and to show visitors to this website relevant ads there.
In the process, cookies are set and, among other things, the IP address, browser and device information, pages visited and the time of the visit are transmitted to Meta. If you are logged in to Facebook or Instagram, Meta can assign the visit to your account.
Legal basis and withdrawal
The Meta Pixel is loaded exclusively after your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. Consent may be withdrawn at any time via “Cookie settings” in the footer.
Joint controllership and transfers to third countries
The controller and Meta are jointly responsible for the collection and transmission of the data to Meta (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. A transfer to Meta Platforms, Inc. in the USA is possible; Meta is certified under the EU-US Data Privacy Framework.
Further information: https://www.facebook.com/privacy/policy/
10. Google Maps
This website embeds the Google Maps map service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in order to display property locations.
The map is only loaded if you allow “External media” in the cookie settings or click “Load map” in the map field. Before that, no data are transmitted to Google. When the map is loaded, the IP address is transmitted to Google; a transfer to the USA cannot be ruled out. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
Further information: https://policies.google.com/privacy
11. Fonts
Google Fonts are used to display fonts consistently. The fonts are served locally from the provider's server; no connection to Google servers takes place in the process.
12. Social networks
The controller maintains profiles on Instagram and Facebook (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland), LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland) and TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland). In the footer of the website, these profiles as well as WhatsApp and Telegram are included as simple links – without plug-ins, buttons that transmit data or embedded content.
The website merely contains links to these profiles. When the website is simply accessed, no data are transmitted to the operators of the networks. Data are only transmitted when the user actively clicks on the respective link. The respective network operator is responsible for the subsequent processing.
When the company profiles are visited, the network operators process usage data, in particular for statistical analyses. With regard to Page Insights, there is joint controllership pursuant to Art. 26 GDPR; the controller has only limited influence over the processing by the networks. A transfer of data to third countries, in particular the USA and China, cannot be ruled out.
13. Contact via WhatsApp and Telegram
WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland) is offered for making contact. If you make contact via WhatsApp, the message content transmitted and the telephone number are processed. The content is end-to-end encrypted; however, metadata are processed by the operator.
Contact can also be made via Telegram. Telegram is a service based outside the EU. Message content, user name or telephone number, and metadata are processed. A transfer to third countries without an adequacy decision cannot be ruled out.
The legal basis is Art. 6(1)(b) or (f) GDPR. Use of both services is voluntary; via the links on the website, data are only transmitted to the provider when clicked; alternatively, telephone, email and the contact form are available.
14. Rights of the data subject
Data subjects have the following rights:
- Access to the personal data processed (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR), unless statutory retention obligations preclude it
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
An informal notification to the contact details given above is sufficient to exercise these rights.
Right to object under Art. 21 GDPR
Where data are processed on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR, there is a right to object to this processing at any time on grounds relating to the particular situation of the data subject. Where the processing is carried out for the purpose of direct marketing, there is a right to object without stating reasons.
Right to lodge a complaint with the supervisory authority
There is a right to lodge a complaint with a data protection supervisory authority. The competent authority is:
The Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit)
Gustav-Stresemann-Ring 1, 65189 Wiesbaden
Telephone: +49 611 1408-0 · Email: poststelle@datenschutz.hessen.de
15. Data security
The website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar changes from “http://” to “https://”. When encryption is activated, the data transmitted cannot be read by third parties.
16. No automated decision-making
No automated decision-making, including profiling, pursuant to Art. 22 GDPR takes place.
17. Currency and amendment of this privacy policy
This privacy policy is currently valid and has the version date stated above. Further development of the website or changes in statutory requirements may make it necessary to amend it. The current version can be accessed on the website at any time.