Privacy policy

Controller

Bergjans & Heidemann UG (haftungsbeschränkt), Eppendorfer Baum 11, 20249 Hamburg, Germany, represented by its managing director Moritz Heidemann. Your contacts for data protection are Moritz Heidemann and Till Bergjans: email info@bh-immos.de, phone +49 155 11491528. We have not appointed a data protection officer because we are not required to.

This policy covers the website bh-immos.de, the pages of our client system (CRM) at crm.bh-immos.de that we send you (personal exposé, confirmation, appointment, owner access), and our approach to private sellers.

Hosting and server logs

The website and the CRM run on Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Netlify delivers the pages through a worldwide server network; functions that run on the server (such as sending a form) are executed in a data centre in Frankfurt am Main, Germany. When you open a page, Netlify processes your IP address, the address requested, date and time, browser and operating system and the referring page in log files. We do not store these logs ourselves and do not evaluate them; Netlify keeps them according to its own retention periods. Legal basis: Art. 6 (1) f GDPR; our legitimate interest is a secure, working website.

Netlify acts as our processor under a data processing agreement. Netlify is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses apply in addition.

The CRM’s database and files (property data, photos, enquiries, documents) are stored by Supabase in a data centre in Frankfurt am Main, Germany. Our contracting party is Supabase Pte. Ltd., Singapore, as processor. Where Supabase or its sub-processors can access the data from outside the EU, the European Commission’s standard contractual clauses, which form part of the contract, apply.

No cookies, no tracking

The website sets no cookies and uses no analytics, advertising or social media services. Fonts, videos and images come from our own servers; your browser loads nothing from third parties during your visit.

In your browser’s session storage (sessionStorage) we keep at most two entries that do not relate to you as a person: that the animation of our logo has already played and, if you came via a flyer, that flyer’s code. Both entries disappear when you close the tab.

The pages from our CRM do not set cookies for you either; a login cookie exists only for our staff. We count visits via the QR codes on our flyers, without your IP address (see “Flyers and QR codes”). The only measurement that can be linked to a person concerns the personal exposé and is described below. Should we later use audience or advertising measurement, we will ask for your consent beforehand.

Flyers and QR codes

Our flyers carry a QR code with an address like bh-immos.de/qr/…. When you scan it, our CRM counts the visit. It stores the flyer code, the time and a check value derived from your browser identifier and the date, which lets us recognise repeated visits on the same day. We do not store your IP address. If you then send an enquiry, the flyer code is sent along so that we can see which flyer it came from.

We distribute the flyers together with A&B Solarsysteme UG (haftungsbeschränkt), Eppendorfer Baum 11, 20249 Hamburg, Germany. We share the figures with them: flyer code, time and check value of scans and, for enquiries via a flyer, the date, the postcode and the street, possibly with house number, as far as we know them (for an enquiry about a property your address, for a valuation request that of the property), and whether it led to an instruction or a purchase. We do not pass on names, phone numbers or email addresses.

Legal basis: Art. 6 (1) f GDPR; our legitimate interest is knowing which distribution is worthwhile.

Property images

Property photos and floor plans come from our own CRM (crm.bh-immos.de). Your browser loads them through this website’s image delivery or directly from the CRM; both run on Netlify, and the files are stored with Supabase in Frankfurt. The same log data is processed as when you open a page, and no other provider receives your IP address. When uploading, we remove location and camera data from the photos. Exterior views of a building may be publicly visible. Legal basis: Art. 6 (1) f GDPR.

Enquiries and forms

When you use the website to request an exposé, a viewing, a call back or a valuation, or send us a message, we process your details: name, email address, phone number, your message, for a valuation the details of your property, your language and, where applicable, the flyer code. We need the required fields of the form in order to reply; everything else is voluntary.

The website passes the enquiry to our CRM, where we handle it, and also sends it by email to anfragen@bh-immos.de. This email is sent by Resend (Plus Five Five, Inc., San Francisco, USA) as processor; Resend is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. For enquiries about a property and for valuation requests, the website also creates a contact in our previous brokerage software Propstack (Propstack GmbH, Berlin) for a transitional period, with name, email address, phone number, a note on the enquiry (for property enquiries including your message, for valuation requests the type of property, location, condition and timing) and, where applicable, the flyer code, until the CRM has fully replaced Propstack. General messages sent through the contact form do not go to Propstack.

Enquiries you send through property portals such as ImmoScout24 or Kleinanzeigen reach us by email and are recorded in the CRM in the same way. For viewings we send you a confirmation, a reminder and a link to cancel or ask for a new time. After a viewing we may ask you via a link for a few short details, such as the purpose of the purchase, financing and timing; answering is voluntary.

Legal basis: Art. 6 (1) b GDPR (steps prior to and performance of a contract), for general messages Art. 6 (1) f GDPR.

Personal exposé

You receive the address and full documents of a property only through your personal exposé page; we email you the link to it. There you conclude the brokerage contract with the button “Engage broker” and then see the full exposé. As evidence we store the times, your declarations with the version of the texts and, when you click this button or withdraw online, the IP address and the browser identifier. Legal basis: Art. 6 (1) b GDPR (brokerage contract) and f (evidence in case of dispute). Details are in the privacy notice for prospective buyers on your personal exposé page.

The link belongs to you; please do not pass it on. Without your consent we measure nothing on the full exposé and use no tracking pixels or tracking links in our emails. With your consent to “reading statistics”, the page reports to our CRM when and for how long you view the exposé and whether you open the floor plan, tour, photo gallery, video, contact or PDF, each with your browser identifier. We store nothing on your device for this. Legal basis: Art. 6 (1) a GDPR and § 25 (1) TDDDG. You can withdraw your consent at any time; we delete the values at the latest six months after the marketing of the property has ended.

If an exposé contains a 360° tour or a video hosted by another provider, your browser loads this content from that provider’s server, which receives your IP address.

Electronic signature of the brokerage contract (sellers)

If you as an owner sign your brokerage contract with us electronically, we process your name and email address, the personal link and a confirmation code sent by email (both only as a check value; the code is valid for 10 minutes), the times of sending, opening, code, signature and countersignature, your declarations and your choice on the start of marketing, the name you type, the text of the button and check values (SHA-256) of the contract texts; for the code, the signature and an online withdrawal also your IP address and browser identifier. We do not use a signature provider, and we do not send text messages.

Purposes and legal bases: conclusion and performance of the contract (Art. 6 (1) b GDPR); proof that you agreed to exactly this text, and enforcement of or defence against claims (legitimate interest, Art. 6 (1) f GDPR); retention under commercial and tax law (Art. 6 (1) c GDPR with § 147 AO and § 257 HGB).

Recipients: our service providers for hosting and database (Netlify, Supabase) and for sending emails (IONOS, Resend as a fallback), each as processor.

Retention: contract and log 6 years from the end of the calendar year in which the contract ends; if it serves as a supporting document for our commission invoice, 8 years. IP address and browser identifier 6 years from the end of the calendar year in which the contract ends; if no signature is made, we delete them after 6 months.

You can object at any time to processing based on legitimate interests. We may keep the evidence as long as it is needed for the establishment, exercise or defence of legal claims (Art. 21 (1) GDPR).

Artificial intelligence

For text drafts we use the language model Claude by Anthropic Ireland, Limited, Dublin, Ireland. The AI only makes suggestions. A member of our team checks and edits them and decides before anything is published or sent. We do not make automated decisions within the meaning of Art. 22 GDPR.

We use the AI for:

• exposé texts and their English translation: from the property data with district, postcode and town and from existing texts; we remove the street, house number and the owner’s surname beforehand;
• suggested replies to enquiries: for this the AI receives the salutation, first and last name and message of the person enquiring (without the property’s street and house number), key facts of the property and the status of the enquiry;
• explanations of price estimates for owners: property data with postcode, town and district, without street or house number, the comparable values and our notes on it; the notes may contain names;
• messages to private sellers: key facts of the listing (type of property, district, price and price changes, areas, rooms, year of construction, portal, time online), the seller’s name if known and up to three of our previous messages to them. These drafts are also created automatically for open entries whose phone number and email address are not on the block list;
• suggestions for the outcome and follow-up date from our call notes with private sellers: title and district of the listing and the note itself, which may contain names.

We send only what the draft in question needs. We do not give the AI the phone numbers or email addresses of the people we write to; they are included only if they appear in the text of a message or note. Legal basis: Art. 6 (1) f GDPR; our legitimate interest is drafting texts faster and with care.

Anthropic acts as our processor under its Data Processing Addendum, which forms part of its commercial terms. Processing may take place in the USA; the European Commission’s standard contractual clauses apply to this. Anthropic does not use data from commercial use to train its models and, according to its own information, deletes inputs and outputs within 30 days unless longer storage is required by law or needed to enforce its usage policy.

Contacting private sellers

If you offer your property privately on a portal, we may contact you and offer our services as estate agents. We did not receive this data from you, so we inform you here under Art. 14 GDPR:

• Source: the market data service IMV (imv-online.de), which compiles public listings, notifications from the portals ImmoScout24, Kleinanzeigen, Immowelt and Immonet, and your listing itself.
• Data: details from the listing (type of property, location, price and price changes, areas, rooms, year of construction, link to the listing), your name, phone number and email address where given in the listing, a message or a conversation, plus our contact attempts, notes from conversations and your replies. If you show interest in the conversation, we create a contact for you in our CRM (salutation, name and email address you give us, and your phone number; your home address only if you give it to us). This contact follows the retention below.
• Permission for further calls: we ask whether we may call you again about the sale. If you expressly say yes, we record this with the wording of the question, the time, the phone number, the property and the name of our employee. We must keep this proof for five years from the permission and after each call (§ 7a UWG; legal basis Art. 6 (1) c GDPR). You can withdraw the permission at any time; a short sentence by phone or message is enough.
• Purpose and channel: we call you or write to you via the portal, by text message or WhatsApp from our business phone to arrange a conversation. If you are not interested but have not expressly declined, we get in touch again no earlier than six months later.
• Tools: the AI may suggest message texts (see above). To show listings on an internal map, we send the street (if known, possibly with house number), postcode, town and district of the listing, without names, to the address service Photon (photon.komoot.io) by komoot. Once a week we open the listing link to see whether it is still online.
• Legal basis: Art. 6 (1) f GDPR; our legitimate interest is offering our services to owners who want to sell.
• Objection and block list: tell us by phone or message that you no longer want to be contacted. We stop immediately and put your phone number and email address with name and date on our block list, so that we do not contact you about future listings either. We use the block list for this purpose only. On request we delete the remaining details immediately; they then stay in the CRM’s recycle bin for 30 days and are removed for good afterwards.
• Retention: if no instruction results, we move the entry with the details from the listing, your contact details, our contact attempts and notes to the recycle bin twelve months after the last contact or the last record on it (such as a price change in the listing or the renewed follow-up after six months). This does not apply to entries with an ongoing handover to our agents, an appointment or an instruction. Your contact in the CRM moves to the recycle bin together with the entry once nothing else belongs to it (such as a property, an enquiry or an appointment within the last twelve months). 30 days later both are deleted for good. If you permitted further calls, we keep your contact with the proof for five years from the permission, the last call or the withdrawal, and once contact has ended we use it only as proof during that time. We keep the block list for as long as we contact private sellers.

Owner access

If you instruct us to sell, you receive a personal link (crm.bh-immos.de/o/…) without a password. There you see the progress of the marketing and figures such as enquiries, viewings and exposé views, only as totals without names of prospects. You can upload documents there (PDF and photos up to 4 MB). We store uploaded files in the CRM with Supabase in Frankfurt; a member of staff checks them before we use them. Please do not pass the link on, and tell us if it has fallen into the wrong hands. Legal basis: Art. 6 (1) b GDPR (brokerage contract).

Email

Our mailboxes are hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, a German provider, as processor. We send emails from the CRM through these mailboxes and only as a fallback through Resend (see above). The CRM reads incoming emails, assigns portal enquiries, replies and offers to the matching case and stores them there. From our staff’s personal mailboxes it takes only portal notifications, IMV alerts and replies to emails sent from the CRM. The legal basis depends on the purpose of the email, usually Art. 6 (1) b or f GDPR.

WhatsApp and phone

If you write to us on WhatsApp or we write to you there, WhatsApp Ireland Limited, Dublin, processes the message under its own terms; data may be transferred to the USA. We use WhatsApp and text messages only from our business phone, without add-on services. If you prefer, call us or send an email. We do not record phone calls; we note the outcome and arrangements in the CRM. Legal basis: Art. 6 (1) b GDPR where the communication concerns a contract with you or pre-contractual steps you initiated; otherwise Art. 6 (1) f GDPR, for example when we contact private sellers (see above).

Retention

We keep data only for as long as we need it for the purpose in question or are required by law to keep it:

• Enquiries that do not lead to a brokerage contract: six months after the last contact.
• Brokerage contract, evidence of the cancellation policy and commission: 5 years from the end of the calendar year in which the contract ends (§ 14 MaBV); if no contract is concluded, we delete the IP address and browser identifier from the evidence after 6 months; commercial and tax records up to ten years (§ 257 HGB, § 147 AO).
• Electronic signature of the brokerage contract (sellers): contract and log 6 years from the end of the calendar year in which the contract ends; if it serves as a supporting document for our commission invoice, 8 years. IP address and browser identifier 6 years from the end of the calendar year in which the contract ends; if no signature is made, we delete them after 6 months.
• Identification under the German Anti-Money Laundering Act, which we must carry out once there is serious interest in a purchase: five years after the end of the year in which the business relationship ends (§ 8 GwG; legal basis Art. 6 (1) c GDPR).
• Measurements of the personal exposé: until six months after the marketing has ended (sold, archived or withdrawn); after an objection we delete them immediately.
• Contacting private sellers: see above, moved to the recycle bin twelve months after the last contact or record, deleted for good 30 days later; proof of a permission for further calls five years from the permission, the last call or the withdrawal (§ 7a UWG); block list for as long as we contact private sellers.
• Flyer scans: two years after the scan.
• Server logs: Netlify keeps them according to its own retention periods; we do not store them ourselves.
• Deleted contacts, leads and tasks stay in the CRM’s recycle bin for 30 days and are then removed for good. A deleted contact is kept longer as long as enquiries, leads, properties, entries as a prospective buyer of a property, invoices, proofs or documents with a running retention period still belong to it (for a company, also persons assigned to it) or the proof of a permission for calls must still be kept (see above); it is removed once these have been deleted.

Recipients and processors

These service providers process data on our behalf and on our instructions:

• Netlify, Inc., San Francisco, USA: hosting of the website and CRM, image delivery. Data Privacy Framework and standard contractual clauses.
• Supabase Pte. Ltd., Singapore: database and file storage in Frankfurt am Main. Standard contractual clauses.
• IONOS SE, Montabaur, Germany: mailboxes and domain.
• Plus Five Five, Inc. (Resend), San Francisco, USA: sending form emails, fallback for emails from the CRM. Data Privacy Framework and standard contractual clauses.
• Anthropic Ireland, Limited, Dublin: AI drafts. Standard contractual clauses for processing in the USA.
• Propstack GmbH, Berlin: previous brokerage software, transitional only, until the CRM has fully replaced it. It still holds data from the time before the CRM, and for property enquiries and valuation requests the website also creates a contact there.

These parties receive data under their own responsibility, as far as the purpose requires:

• komoot (address service Photon, photon.komoot.io): addresses for which we need coordinates for our internal maps, always without names. These are the location of listings by private sellers and of valuation requests (street if known, possibly with house number, postcode, town, district), addresses for price estimates and comparable values (street with house number, postcode, town, district) and, for flyer distribution, street names, search terms for address suggestions and individual points of the distribution routes, for which Photon returns postcode and town.
• A&B Solarsysteme UG (haftungsbeschränkt), Hamburg: evaluation of jointly distributed flyers. Scans (flyer code, time, check value) and, for enquiries via a flyer, date, postcode, street possibly with house number and whether it led to an instruction or purchase; without names or contact details.
• Property portals (ImmoScout24, Kleinanzeigen, Immowelt, Immonet) and WhatsApp Ireland Limited: when you write to us or we write to you through them.
• Providers of embedded tours or videos: your IP address when the content loads.
• In a purchase or sale: the notary, buyer or seller and, with your agreement, financing banks; authorities only where we are legally obliged.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7 (3)). Write to info@bh-immos.de or call us.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.