Privacy policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

condium GmbH, Rothestraße 10, 22765 Hamburg, Germany. Represented by: Alexander Spina. Email: condium@condium.de. Phone: +49 40 2804422.

We have not appointed a data protection officer. An appointment is not mandatory, as we do not, as a rule, have at least 20 people constantly engaged in the automated processing of personal data.

2. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Pages are delivered via a global server network; the contact form is processed in Frankfurt am Main, Germany.

When you access the website, information transmitted by your browser is recorded automatically: IP address, date and time of access, page requested, volume of data transferred, referrer URL, browser type and operating system.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and uninterrupted operation of the website and in defending against attacks. This data is not combined with other sources.

3. Contact form

You can submit a no-obligation enquiry via the contact form. In doing so we process the following information:

• —Type of property (residential and/or commercial)
• —Number of units in your portfolio
• —Postcode and number of units per location
• —Name, email address and phone number
• —Language of the enquiry and time of receipt

4. Purpose, legal basis and retention

We process this data solely to handle your enquiry, assess your portfolio and discuss a possible working relationship with you.

The legal basis is Art. 6(1)(b) GDPR, as the processing serves to take steps at your request prior to entering into a contract. We additionally rely on Art. 6(1)(f) GDPR where general enquiries are concerned.

Providing the data is neither legally nor contractually required. Without the fields marked as mandatory, however, we cannot process your enquiry.

We delete your enquiry once it has been dealt with conclusively and no statutory retention obligations apply. If a contractual relationship comes about, the commercial and tax retention periods of six and ten years respectively apply (§ 257 HGB, § 147 AO).

5. Storage of enquiries and notification

Data submitted through the contact form is stored in our property management database, operated by Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Supabase processes the data as a processor pursuant to Art. 28 GDPR; the database is located in the Frankfurt, Germany region (eu-central-1).

Through the website, enquiries can only be created — they cannot be read, modified or deleted.

We notify our management of each new enquiry by email. Our email runs on Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, likewise as a processor pursuant to Art. 28 GDPR.

6. Transfers to third countries

Vercel and Supabase are companies established outside the European Union; Microsoft Ireland belongs to a US group. Even where data is held within the EU, access from a third country cannot be entirely ruled out.

Vercel Inc. and Microsoft are certified under the EU-U.S. Data Privacy Framework; these transfers are therefore covered by an adequacy decision of the European Commission (Art. 45 GDPR). The EU standard contractual clauses apply in addition.

Supabase Pte. Ltd is based in Singapore; no adequacy decision by the European Commission exists for Singapore. The transfer is therefore based on the EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR (Commission Implementing Decision (EU) 2021/914).

7. No cookies, no tracking

This website sets no cookies and uses no analytics or tracking services, no advertising networks and no social media plugins. No profiling and no automated decision-making take place.

The fonts used are served from our own server. There is no connection to third-party servers, in particular not to Google Fonts; your IP address is not transmitted to third parties.

For this reason the website requires neither a cookie banner nor consent under § 25 TDDDG.

8. Recipients of the data

Your data is passed on only to the processors named above and, where necessary, to service providers engaged by us in the course of performing a contract. Your data is not sold and is not passed to third parties for advertising purposes.

9. Your rights

You have the following rights in relation to us:

• —Access to the data processed about you (Art. 15 GDPR)
• —Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• —Erasure of your data (Art. 17 GDPR)
• —Restriction of processing (Art. 18 GDPR)
• —Data portability in a commonly used format (Art. 20 GDPR)
• —Objection to processing based on legitimate interests (Art. 21 GDPR)
• —Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

10. Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, place of work or the place of the alleged infringement.

The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

11. Data security

Transmission between your browser and our website is encrypted via TLS (indicated by “https” and the padlock icon in your address bar). We also take technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

12. Chat on the website

On the homepage you can put questions to a chat. The answers are generated by an AI language model provided by Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. Anthropic processes the data as a processor pursuant to Art. 28 GDPR; API inputs are not used by Anthropic to train models. The transfer to the USA is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

We process the conversation, the language of the site, the time and a daily hash of your IP address from which the address cannot be recovered; it serves only to limit usage. The conversation is stored in our property management database (section 5) and deleted after 90 days unless an enquiry resulted from it. The conversation id is kept in your browser's session storage for the duration of your visit (not a cookie).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering prospective clients' questions immediately. If you provide contact details in the chat to make an enquiry, sections 3 and 4 apply. Please do not enter third parties' data or special categories of personal data in the chat.

13. Changes to this privacy policy

We update this privacy policy whenever changes to our processing or to the legal situation make it necessary. The version published on this page at the time applies.