Privacy Policy

1. Data Controller

The data controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Estate-Service24 Immobilienconsulting

Hegewiese 63

61389 Schmitten im Taunus

Germany

Owner / contact person: Alexander Ufnarovski

Phone: +49 172 953 48 07

Email: info@estate-service24.de

Website: www.estate-service24.de

2. General Information on Data Processing

We process personal data of visitors and users of our website solely within the framework of applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the German Telecommunications-Digital-Services-Data-Protection Act (TDDDG).

Personal data means any information relating to an identified or identifiable natural person. This may include, in particular, name, contact details, IP address, and information you provide to us in connection with an inquiry.

We process personal data only to the extent necessary for providing our website, processing inquiries, initiating or conducting a business relationship or — with your consent — analysing the use of our website.

3. Hosting and Website Provision – Webflow

This website is built and hosted using the Webflow service.

Provider:

Webflow, Inc.

398 11th Street, 2nd Floor

San Francisco, CA 94103

USA

When you visit our website, technically necessary data may be processed. This may include, in particular, IP address, date and time of access, pages or files accessed, browser type and version, operating system, and other technical connection data.

This processing serves the purpose of ensuring the secure, stable and technically error-free provision of our website.

As part of its hosting and CDN infrastructure, Webflow uses technical infrastructure and sub-processors. These include, in particular, Amazon Web Services, Inc. (hosting and cloud services) and Cloudflare, Inc. (content delivery network), each based in the USA.

Cloudflare is not operated or administered by us as a separate proxy, CDN, WAF or comparable service, but is part of the technical infrastructure provided by Webflow.

Within this infrastructure, technically necessary cookies or comparable technologies may be used. Under the current technical configuration, this includes in particular the cookie “_cfuvid”, which serves technical purposes such as the secure and reliable provision of the website and the management of network traffic.

The processing of personal data in connection with the provision and securing of the website is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and reliable provision of our website.

Where strictly necessary information is stored on or read from the end device, this takes place within the statutory framework for strictly necessary technologies pursuant to § 25(2) no. 2 TDDDG; no consent is required for this.

As Webflow is based in the USA and may use service providers in the USA as part of its technical infrastructure, processing of personal data in the United States may take place.

Webflow is certified under the EU-U.S. Data Privacy Framework. In addition, Webflow states that it provides appropriate safeguards for international data transfers, in particular the European Commission’s Standard Contractual Clauses.

Further information on data processing can be found in Webflow’s privacy notices.

4. Server Log Files

When you visit our website, the following information may be processed for technical reasons, in particular:

• IP address,

• date and time of access,

• page or file accessed,

• browser used and its version,

• operating system used,

• referrer URL,

• other technical access information.

This processing serves the technical provision of the website and ensures its stability and security.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional provision of our website. The server log files are collected by our hosting provider Webflow as a processor acting on our behalf. We do not combine them with other data sources or analyse them to identify individual visitors. The log data is deleted as soon as it is no longer required for the stated purposes.

5. Cookies and Consent Management with Cookiebot

Our website uses cookies and comparable technologies.

Under the current technical configuration, the following categories are used on our website:

• Necessary: technically necessary technologies, in particular for the secure and reliable provision of the website, including technically necessary functions of the Webflow/Cloudflare infrastructure, and for storing the cookie choices made by the user;

• Statistics: Google Analytics, exclusively after the user’s prior consent.

Cookies and technologies of the categories Preferences and Marketing are currently not used.

To manage your consent, we use Cookiebot, a consent management platform provided by Usercentrics.

Provider:

Usercentrics A/S

Havnegade 39

1058 Copenhagen

Denmark

Cookiebot allows you to decide, when visiting our website, whether you consent to the use of statistical cookies and comparable technologies.

Technically necessary cookies may be used without prior consent, provided the statutory requirements are met.

The “Statistics” category is deactivated by default. Google Analytics is activated only once you actively consent to this category. Without your consent, Google Analytics remains blocked.

Your consent is voluntary. You can change your choice at any time with effect for the future, or withdraw consent already given, via the cookie settings provided on our website.

Cookiebot processes information required to store your consent decision and to be able to prove it. This may include, in particular, information about your consent decision, the time of consent, technical information about the device or browser used, and a pseudonymous identifier.

Your consent decision is processed in order to fulfil our legal obligations and to document that consent was duly given or refused.

The legal bases for this are Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

To store your choice, Cookiebot sets the cookie “CookieConsent”. As this cookie is strictly necessary to respect your consent decision, it is stored on your end device without consent pursuant to § 25(2) no. 2 TDDDG.

Usercentrics processes the data as our processor pursuant to Art. 28 GDPR on servers within the European Union.

Where, in connection with technologies requiring consent, information is stored on or read from your end device, this takes place on the basis of your consent pursuant to § 25(1) TDDDG.

6. Contact via Email or Phone

If you contact us by email or phone, we process the personal data you provide for the purpose of handling and responding to your inquiry.

This may include, in particular:

• name,

• email address,

• phone number,

• content of your inquiry,

• other information voluntarily provided.

If your contact is aimed at initiating or performing a contractual relationship, processing is based on Art. 6(1)(b) GDPR.

In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the appropriate handling of inquiries from prospective clients and business partners.

7. Contact and Investment Inquiry via Form

Our website provides a form for contacting us and submitting an individual investment inquiry.

The form may collect, in particular, the following information:

• first and last name,

• country of residence,

• investment objective,

• desired type of property or investment,

• investment budget,

• desired region,

• investment horizon,

• email address,

• phone number,

• details for a preferred messenger contact, such as Telegram or WhatsApp,

• other voluntarily provided information.

We use this data to process your inquiry, to contact you and, where applicable, to prepare an advisory, brokerage or other business relationship.

If you wish to be contacted via a messenger service (e.g. WhatsApp or Telegram), we will contact you via the service you have chosen. In doing so, the respective provider (e.g. WhatsApp Ireland Limited or Telegram Messenger Inc.) also processes your data under its own responsibility and, where applicable, in third countries for which no adequacy decision exists. Use takes place exclusively at your request (Art. 6(1)(b) GDPR); alternatively, you can choose to be contacted by email or telephone at any time.

Data submitted via the form is stored in Webflow and additionally forwarded to the email address designated for handling inquiries.

If your inquiry is aimed at initiating a contractual relationship, processing is based on Art. 6(1)(b) GDPR.

In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in processing inquiries from prospective clients and business partners.

Where we separately ask for your consent in the form (e.g. for sending further investment offers), processing takes place on the basis of Art. 6(1)(a) GDPR. Consent given may be withdrawn at any time with effect for the future.

Providing the information marked as mandatory fields is necessary for us to process your inquiry. Further information is provided voluntarily.

8. Storage of Form Data by Webflow

When you use our contact or investment form, the data you submit is stored on the Webflow platform.

Webflow processes this data as part of the technical provision of the form function exclusively on our behalf as a processor pursuant to Art. 28 GDPR. The legal basis is Art. 6(1)(b) GDPR or — outside pre-contractual inquiries — Art. 6(1)(f) GDPR (legitimate interest in the reliable receipt and documentation of inquiries).

Form entries are stored in Webflow until we delete them. We delete them regularly, unless a business relationship is established or statutory retention obligations preclude this.

As Webflow is based in the USA, personal data may be processed or stored in the United States.

Webflow is certified under the EU-U.S. Data Privacy Framework. For international data transfers, Webflow also states that it provides appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses.

Data received via the form is used by us to process your inquiry and, where applicable, to initiate or conduct a business relationship.

9. Google Analytics 4

Where you have given your consent, we use Google Analytics 4 on our website, a web analytics service provided by

Google Ireland Limited

Gordon House

Barrow Street

Dublin 4

Ireland.

Google Analytics enables us to statistically evaluate the use of our website. The information obtained helps us understand how visitors use our website and improve our offering accordingly.

Within Google Analytics, information about the following activities and characteristics may in particular be processed:

• pages viewed,

• time and duration of the visit,

• interactions with the website,

• approximate geographical region,

• device and browser information,

• operating system,

• origin of the website visit,

• technical usage and event data.

Google states that individual IP addresses of users from the European Union are not logged or stored in Google Analytics. IP addresses are processed to derive approximate location information and are then discarded.

Google Analytics is deactivated by default and is activated on our website only after your prior consent.

To do so, you must actively consent to the “Statistics” category in the cookie banner. Without your consent, the consent management system Cookiebot blocks Google Analytics and the corresponding transmission of analytical data. Where Google Consent Mode is used, this is done exclusively in basic mode; before your consent, no Google tags are loaded and no data — including cookieless signals — are transmitted to Google.

The legal basis for the processing of personal data within Google Analytics is your consent pursuant to Art. 6(1)(a) GDPR.

Where information is stored on or read from your end device, this takes place on the basis of your consent pursuant to § 25(1) TDDDG.

You can withdraw or change your consent at any time with effect for the future via the cookie settings on our website.

We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR (Google Ads Data Processing Terms). Google Signals and the linking with Google advertising services are deactivated.

Google Analytics sets the cookies “_ga” and “_ga_<ID>” with a lifetime of up to two years.

When Google Analytics is used, data may be processed by Google companies outside the European Union or the European Economic Area, in particular in the USA.

Google LLC is certified under the EU-U.S. Data Privacy Framework. For international data transfers, appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses, may additionally be used.

Further information on the processing of personal data by Google can be found in Google’s privacy information.

10. Locally Hosted Fonts

The fonts used on our website, in particular Inter, Manrope and Cormorant Garamond, are provided locally via our website.

The fonts are not loaded from Google servers via the Google Fonts API when our website is accessed.

Because the fonts are hosted locally, no connection to Google Fonts is established when they are loaded, and no visitor IP address is transmitted to Google for this purpose.

11. Recipients of Personal Data

Personal data is only disclosed to the extent necessary for the purposes described in this privacy policy, where there is a legal obligation to do so, or where you have consented to the disclosure.

Technical service providers or recipients used may include, in particular:

• Webflow for providing and hosting the website and for processing form inquiries; in doing so, Webflow may use technical sub-processors, in particular Cloudflare, as part of its hosting and CDN infrastructure,

• our email service provider IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, for transmitting and handling incoming contact inquiries,

• Usercentrics / Cookiebot for managing and documenting your cookie consents,

• Google within the scope of Google Analytics, provided you have consented to statistical analysis.

Where service providers process personal data on our behalf, this takes place on the basis of data processing agreements pursuant to Art. 28 GDPR.

If a specific transaction takes place, we transmit the data required for this (Art. 6(1)(b) GDPR), in particular to the owner or seller of the property and their representatives, to the notary certifying the transaction and — at your request — to your advisers and financing bank.

12. Data Transfers to Third Countries

When using certain service providers, in particular Webflow and Google, personal data may be processed outside the European Union or the European Economic Area, in particular in the USA.

As part of its technical hosting and CDN infrastructure, Webflow may use sub-processors based in third countries.

Where necessary, such transfer takes place on the basis of an adequacy decision by the European Commission, in particular the EU-U.S. Data Privacy Framework, provided the respective recipient is certified accordingly, or on the basis of other appropriate safeguards pursuant to Art. 46 GDPR, in particular the European Commission’s Standard Contractual Clauses.

13. Storage Period

We generally store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

Data from contact and investment inquiries is generally deleted once the inquiry has been fully processed and no further business relationship arises, unless statutory retention obligations or other legal grounds require longer storage.

Where a business or contractual relationship arises, the data required for this may be stored in accordance with the statutory commercial and tax retention periods (§ 257 HGB, § 147 AO; depending on the document, six, eight or ten years). As a real estate broker, we are also an obliged entity under the Anti-Money Laundering Act (§ 2(1) no. 14 GwG); the information and documents collected for identification are processed by us pursuant to Art. 6(1)(c) GDPR in conjunction with §§ 10 et seq. GwG and retained for five years pursuant to § 8(4) GwG.

For data processed by service providers used, the respective storage and deletion periods of the service concerned also apply.

Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

14. Rights of Data Subjects

Under the applicable statutory requirements, you have, in particular, the following rights:

• right of access under Art. 15 GDPR,

• right to rectification under Art. 16 GDPR,

• right to erasure under Art. 17 GDPR,

• right to restriction of processing under Art. 18 GDPR,

• right to data portability under Art. 20 GDPR,

• right to object under Art. 21 GDPR,

• right to withdraw consent under Art. 7(3) GDPR.

Consent given may be withdrawn at any time with effect for the future. The lawfulness of processing carried out on the basis of consent before withdrawal is not affected.

To exercise your rights, you may contact us at any time using the contact details provided above.

Automated decision-making, including profiling, pursuant to Art. 22 GDPR does not take place.

15. Right to Object

Where we process personal data on the basis of Art. 6(1)(f) GDPR due to legitimate interests, you have the right under Art. 21 GDPR to object at any time to such processing for reasons arising from your particular situation.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing.

16. Right to Lodge a Complaint with a Supervisory Authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.

You may contact, in particular, the data protection supervisory authority of your place of habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority responsible for us is: The Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

17. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access or other unauthorised processing.

Our website uses an encrypted HTTPS connection. This protects data transmitted between your browser and our website against unauthorised access by third parties.

18. Changes to This Privacy Policy

We reserve the right to amend this privacy policy where changes to our website, the services used or legal requirements make this necessary.

The version published on this website at any given time shall apply.

Last updated: October 2026

This English version is provided for information purposes only; the German version is legally binding.