Privacy Policy
A. General Information
The following general information applies to our website (accessible via this link https://de.everreal.co/) as well as the EverReal platform (accessible via this link https://app.everreal.co/ (together, the "Services").
The protection of information relating to you, such as your name and your email or IP address (so-called personal data), is an important concern for us. Therefore, we operate our services in accordance with the applicable data protection laws, in particular the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). Below you will find an explanation of how we handle your personal data in this context.
According to the GDPR, personal data is any information relating to an identified or identifiable natural person (“data subject”). A natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical identity of that person (“personal data”). Data that can only be assigned to a legal entity does not constitute personal data and is therefore subject neither to the provisions of this privacy policy nor to the GDPR.
1. Who is the data controller?
Responsible for our services is
EverReal GmbH
Managing Director: Nessim Djerboua, Liviu Ignat
Isartorplatz 8, 80331 Munich, Germany
2. Who is the data protection officer?
If you have any questions or concerns regarding data protection, please contact our external data protection officer:
PROLIANCE GmbH
Leopoldstraße 21
80802 Munich
When contacting the data protection officer, please specify the company your inquiry refers to. Please do not provide any sensitive information, such as a copy of your ID.
3. What do we do with your personal data?
a) When you visit the websites of our services or contact us
Providing this website requires the processing of personal data, such as your IP address. This processing is necessary to retrieve the content displayed on this website (including its functions) as well as for IT security measures.
You also have the option to contact us (e.g., by email). For this purpose, we collect those personal data that you provide to us in the course of contacting us.
(1) Legal basis
The processing of your personal data for the provision of the website and for contacting us is based on our overriding legitimate interest. For the provision of this website, it is technically necessary for us to process certain personal data (e.g. the IP address). For your communication with us, it is necessary that we handle your respective personal data.
(2) Balancing of interests
As part of the necessary balancing of interests, we have weighed your interest in confidentiality against our interests in providing this website and contacting you. In each case, your interest in confidentiality is subordinated. Otherwise, we would not be able to provide this website to you or respond to your contact request.
(3) Categories of recipients
We employ service providers in the context of making the website available and contacting you. Our website is hosted and delivered by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands; in doing so, Framer processes the data that is technically necessary to retrieve the website, such as your IP address. Framer also provides built-in page-view statistics (events.framer.com, without cookies or any other storage on your device) and the script for editing the page in the Framer editor. The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). Where data is transferred to third countries in this context, this is safeguarded by standard contractual clauses. These service providers process personal data partly outside the EU / EEA (see the section “Data transfer to third countries” below). For this purpose, we transfer personal data to this service provider. This service provider is obligated by us to exercise the same care in processing personal data as we do ourselves.
b) If you subscribe to our newsletter
You can register for our newsletter on our website by providing the corresponding consent. For this purpose, we collect the personal data that you enter into the registration form. Furthermore, we analyze the reach of our newsletter via our service provider ActiveCampaign (see the "ActiveCampaign" section below for details). This enables us to analyze your newsletter behavior.
(1) Legal basis
Your consent is the legal basis for our data processing. You can withdraw your consent at any time with effect for the future. You can also unsubscribe using the opt-out function at the end of the respective newsletter.
(2) Categories of recipients
We use ActiveCampaign as part of our newsletter service. This service provider partially processes personal data outside the EU / EEA (see the "Data transfer to third countries" section below). We transfer personal data to this service provider for this purpose. This service provider is obligated by us to exercise the same care in processing personal data as we do ourselves.
c) If you follow us on social media platforms
You have the opportunity to follow us on social media platforms (e.g., LinkedIn, XING, Twitter, Facebook, and Instagram). For this purpose, we process the personal data that you provide to us or that is made available to us about you by the respective platform operator, to the extent that it is provided to us. You can control the privacy settings yourself within the framework of the social media platforms.
(1) Legal basis
The processing of your personal data within the scope of our social media offerings is based on our legitimate interest. To provide our social media offerings, it is technically necessary for us to process certain personal data (e.g., the IP address; personal data that you have made available to the respective platform operator or to us).
(2) Balancing of interests
As part of the necessary balancing of interests, we have weighed your interest in confidentiality against our interests in providing our social media offerings. Your interest in confidentiality is subordinated in this case. Otherwise, we would not be able to offer our social media services to you. In addition, you must reasonably expect that personal data will be processed when using LinkedIn, XING, Twitter, Facebook, Instagram, and other social media platforms.
(3) Categories of recipients
We use service providers to provide our social media offerings (e.g. LinkedIn, XING, Twitter, Facebook and Instagram). The data you transmit to us within the scope of our social media offerings is also automatically transmitted to the respective social media platform operators, including to countries outside the EU / EEA (see the section "Data transfer to third countries" below).
d) If we anonymize your personal data
We anonymize your personal data in order to analyze it for statistical purposes.
(1) Legal basis
The processing of your personal data in the context of such anonymization is based on our overriding legitimate interest.
(2) Balancing of interests
Within the framework of the necessary balancing of interests, we have weighed your interest in confidentiality against our interests in corresponding anonymization. In this case, your interest in confidentiality takes a back seat. Otherwise, we would not be able to achieve such anonymization. The GDPR and the BDSG are not applicable to anonymous data.
(3) Categories of recipients
We use service providers for the anonymization process. For this purpose, we transfer personal data to these service providers. These service providers are contractually obligated by us to exercise the same care in handling personal data as we do ourselves.
e) If we sell our company and/or a service
We reserve the right to sell our company and/or a service in whole or in part. In doing so, we may transfer your personal data to a third party in the future, in compliance with the respective data protection requirements. We will inform you of this with an advance notice period of at least 30 days, indicating the consequences for the further use of our services.
(1) Legal basis
The processing of your personal data in the context of such a sale is based on our overriding legitimate interest. For the execution of a corporate transaction, it may be necessary for us to transfer your respective personal data to a third party.
(2) Balancing of interests
As part of the necessary balancing of interests, we have weighed your interest in confidentiality against our interest in making a corresponding sale. In each case, your interest in confidentiality is subordinated. Otherwise, we would not be able to process such a sale.
f) If you cancel a contract
If you cancel a contract in connection with the use of our services, we process personal data such as your name, details to identify the contract, your email address and, if applicable, the subject matter of the contract and the contract term, as well as payment data and other details that you communicate to us in connection with the cancellation, in order to process your cancellation and wind up the contractual relationship.
The legal basis for this processing is the fulfillment, performance, and execution of the contractual relationship as well as the fulfillment of legal obligations.
g) If you create a digital application folder (“BewerberPass”)
You have the option of creating an applicant account with a reusable application folder (“BewerberPass”) on our platform. This also allows you to apply across the boundaries of individual customers without having to fill out a form again for each application. We process personal data such as details about you, your household and your employment, references to uploaded supporting documents (e.g. proof of income) and other data that you provide to us in connection with the application folder, such as your self-description.
We compare your details with the requirements profile of a listing (e.g. household size, household income, desired move-in date) and derive a so-called matching score from them. On this basis, you are only notified about listings, or your details are only forwarded to landlords, that are likely to suit you.
In addition, your uploaded supporting documents are read by automated means, condensed into a clear summary and checked for completeness.
(1) Legal basis
Your consent is the legal basis for our data processing. You can withdraw your consent at any time with effect for the future. Withdrawal is possible in your account.
(2) Categories of recipients
We forward your application to the provider of the offer you are applying for.
4. How long do we store your personal data?
We delete your personal data when the respective purpose of storage no longer applies and no legal regulation requires retention.
5. What are your rights as a data subject?
Please contact the above-mentioned contact details to exercise your rights and to withdraw your consent.
a) You have the right to request information at any time about all personal data that we process about you.
b) If your personal data is incorrect or incomplete, you have the right to rectification and completion.
c) You can request the deletion of your personal data at any time, provided that we are not legally obliged or entitled to continue processing your data.
d) If the legal requirements are met, you may request a restriction on the processing of your personal data.
e) You have the right to object to the processing, provided that the data processing is carried out for the purpose of direct marketing or profiling. If the processing is based on a balancing of interests, you may object to the processing by stating reasons arising from your particular situation.
f) If the data processing is based on your consent or within the framework of a contract, you have the right to the transfer of the data provided by you, provided that this does not affect the rights and freedoms of other persons.
g) Insofar as we process your data on the basis of a declaration of consent, you have the right to withdraw this consent at any time with effect for the future. Processing carried out prior to a withdrawal remains unaffected by the withdrawal.
h) You also have the right to lodge a complaint with a data protection supervisory authority at any time if you believe that data processing has been carried out in violation of applicable law.
We will notify all recipients to whom we have disclosed personal data of any rectification or erasure of your personal data or any restriction of the corresponding processing, unless this proves impossible or involves disproportionate effort. We will inform you about the relevant recipients for you if you request this.
6. In what context do we create automatic profiles?
No automatic profiles are created.
7. Data transfer to the USA
In some cases, personal data is transferred to recipients in third countries (see the corresponding information in each case within our privacy policy). Third countries are countries outside the EU / EEA. These third countries also include the USA.
The level of data protection in the USA is not comparable to that in Europe. In particular, it is possible for government agencies to access personal data without our or your knowledge. Legal prosecution may not be successful.
The legal basis for such data processing can, in principle, be your consent (Art. 49 para. 1 sentence 1 lit. a) GDPR) or the fulfillment of a contract in each case (Art. 49 para. 1 sentence 1 lit. b) GDPR). Where possible, we also conclude EU Standard Contractual Clauses with our service providers and implement supplementary measures. Further information on this can be found at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.
8. Data Security
We take appropriate technical and organizational security measures to protect the personal data processed by us against accidental or intentional manipulation, loss, destruction, or against unauthorized access.
9. Competent data protection authority
Bavarian State Office for Data Protection Supervision
Promenade 18, 91522 Ansbach
Tel.: +49 (0)981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de
https://www.lda.bayern.de
B. Additional privacy notices for our website
1. What else do we do with your personal data?
a) If you allow the use of cookies and analysis tools in your browser
We use cookies and analysis tools to provide our website. Some providers we use also process your personal data outside the EU / EEA (see the section "Data transfer to third countries" below). Cookies are data records that are stored by a web server on the user's end device (e.g., computer, smartphone, or tablet). When our website is accessed again using the same end device, these are sent back either to our website ("First Party Cookies") or to another website to which the cookie belongs ("Third Party Cookies").
(1) Legal basis
The legal basis for the use of technically necessary cookies/identifiers is our legitimate interest. The storage of information in the terminal equipment or access to information already stored in your terminal equipment is strictly necessary in order for us to provide the telemedia service explicitly requested by you as a user (Section 25 (2) No. 2 TTDSG; Art. 6 (1) lit. f) GDPR).
Furthermore, unless a specific legal basis is mentioned below, the legal basis is generally your consent (Section 25 (1) TTDSG; Art. 6 (1) lit. a) GDPR). You can withdraw your consent at any time with effect for the future, e.g., by deleting cookies set via your device's browser settings. Please note that for technical reasons, this procedure only applies to the specific device used.
You can also prevent the collection and processing of your personal data by disabling the storage of third-party cookies on your device, using the "Do Not Track" function of a supporting browser, disabling the execution of script code in your browser, or installing a script blocker in your browser.
b) Use of the Usercentrics Cookiebot Consent Management Platform
We use the Cookiebot tool from Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, to enable cookie management on our website.
(1) Legal basis
The processing of your personal data in connection with the use of the Usercentrics Cookiebot Consent Management is based on our overriding legitimate interest.
(2) Balancing of interests
Within the framework of the necessary balancing of interests, we have weighed your interest in confidentiality against our interests in using the Usercentrics Cookiebot Consent Management. Your interest in confidentiality is subordinated in each case. Otherwise, we would not be able to use this management tool.
(3) Categories of recipients
We use Usercentrics as a data processor. For this purpose, we transmit personal data to Usercentrics. Usercentrics is contractually obligated by us to exercise the same care in handling personal data as we do ourselves.
c) Use of Google Analytics
We use Google Analytics on our website, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").
Google Analytics uses cookies that are stored on your device and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, due to the activation of IP anonymization, your IP address will be shortened by Google beforehand within the EU / EEA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide us with other services related to website and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
You can prevent the storage of cookies by selecting the appropriate settings on your browser software; however, please note that in this case you may not be able to use all the functions of our website to their full extent. You can also prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de
In addition, you can prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de
You can deactivate the use of your personal data by Google using the following link: https://adssettings.google.de
Further information on how to object and opt out with Google can be found at: https://policies.google.com/privacy?gl=DE&hl=de
An overview of what data Google collects can be found at: https://privacy.google.com/businesses/adsservices/
d) Use of Google Tag Manager
We use the Google Tag Manager (https://www.google.com/intl/de/tagmanager/) from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).
Google Tag Manager allows tags from Google and third-party services to be managed and embedded in a bundled form on an online presence. Tags are small code elements on an online presence that are used, among other things, to measure visitor numbers and behavior, to record the impact of online advertising and social channels, to use remarketing and targeting, and to test and optimize online presences. When a user visits the online presence, the current tag configuration is sent to the user's browser. It contains instructions on which tags should be triggered. Google Tag Manager ensures the triggering of other tags, which in turn may collect data under certain circumstances. Information on this can be found in the passages on the use of the corresponding services in this privacy policy. Google Tag Manager does not access this data.
Further information on Google Tag Manager can be found at https://www.google.com/intl/de/tagmanager/faq.html and in Google's privacy policy at https://policies.google.com/privacy?hl=de.
You can prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de
You can deactivate the use of your personal data by Google using the following link: https://adssettings.google.de
Further information on how to object and opt out with Google can be found at: https://policies.google.com/privacy?gl=DE&hl=de
e) Twitter Conversion Tracking
We use the remarketing feature of Twitter Inc., 1355 Market St, San Francisco, California 94103, USA ("Twitter"). This allows us to target you with interest-based advertising on the Twitter platform. For this purpose, Twitter uses "tags" to collect data about users of our website and their usage in a pseudonymous, non-personal form. Twitter receives information from your browser that our website was accessed from your device. The information generated by the tags about your use of our services is transmitted to a Twitter server in the USA and stored there.
The use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and Sec. 25 para. 1 TTDSG. Consent can be revoked at any time.
If you do not wish to use the Twitter remarketing function, you can deactivate this function on Twitter at the following address: https://support.twitter.com/articles/20171528.
Further information on Twitter Remarketing and Twitter's privacy policy can be found at https://business.twitter.com/de/help/troubleshooting/how-twitter-ads-work.html.
f) Facebook Pixel
We use the marketing tool Pixel from Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the collected data is also transferred to the USA and other third countries.
This service allows the behavior of website visitors to be tracked and evaluated after they have been redirected to the provider's website via a Facebook advertisement.
The collected data is anonymous to us; we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes. Facebook's privacy policy can be found here: Facebook Data Use Policy. This service is used on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR and Sec. 25 para. 1 TTDSG. Consent can be revoked at any time.
The use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and Sec. 25 para. 1 TTDSG. Consent can be revoked at any time.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.
Further information on protecting your privacy can be found in Facebook's data privacy policy: https://de-de.facebook.com/about/privacy/.
You can deactivate the remarketing function in the ad settings section at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged in to Facebook to do this.
l) LinkedIn Insight Tag
We use the LinkedIn Insight Tag. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
With the help of the LinkedIn Insight Tag, we receive information about the users of our website. If a website visitor is registered with LinkedIn, we can, among other things, analyze the key professional data of our website visitors and thus better align our site with the respective target groups. Furthermore, with the help of the LinkedIn Insight Tag, we can measure whether the visitors to our websites make a purchase or perform another action (conversion measurement). LinkedIn Insight Tag also offers a retargeting function, which we can use to display targeted advertising to visitors of our website outside of our website.
LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser properties, and time of access). The IP addresses are shortened or pseudonymized. LinkedIn will store the collected personal data of website visitors on its servers in the USA and use it for its own advertising measures. Details on this can be found in LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig. The use of this service is based on your consent pursuant to Art. 6 Para. 1 lit. a GDPR and Sec. 25 Para. 1 TTDSG. Consent can be revoked at any time.
The use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and Sec. 25 para. 1 TTDSG. Consent can be revoked at any time.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.
You can object to the analysis of your usage behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
g) Google Ads
We use "Google Ads", an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters specific search terms into Google. Furthermore, targeted advertisements can be displayed based on the user data available to Google. We can analyze this data, for example, by evaluating which search terms led to the display of our advertisements and how many ads resulted in corresponding clicks. This service is used on the basis of your consent in accordance with Art. 6 Para. 1 lit. a GDPR and Sec. 25 Para. 1 TTDSG. Consent can be revoked at any time.
The use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and Sec. 25 para. 1 TTDSG. Consent can be revoked at any time.
Data is being transferred to a third country (USA). The data transfer is based on the European Commission's Standard Contractual Clauses.
h) Bing Ads
We use the "Bing Ads" remarketing function of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. In this process, Microsoft Bing Ads stores a cookie on your computer if you reached our website via a Microsoft Bing advertisement. This enables tracking of the displayed advertisement. We only learn the total number of users who clicked on a Bing ad and were then redirected to the conversion page. No personal information regarding the user's identity is shared. The use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG. Consent can be revoked at any time. Data transfer to a third country (USA) takes place. The data transfer is based on the standard contractual clauses of the EU Commission.
The use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and Sec. 25 para. 1 TTDSG. Consent can be revoked at any time.
Data is being transferred to a third country (USA). The data transfer is based on the European Commission's Standard Contractual Clauses.
You can refuse the setting of cookies required for this purpose, for example, via browser settings that generally deactivate the automatic setting of cookies, or you can also prevent the collection of the data generated by the cookie and related to your use of the website, as well as the processing of this data by Microsoft, by declaring your objection at the following link http://choice.microsoft.com/de-DE/opt-out. Further information on data protection and the cookies used by Microsoft and Bing Ads can be found on the Microsoft website at https://privacy.microsoft.com/de-de/privacystatement.
i) Active Campaign
This website uses Active Campaign to send newsletters. The provider is Active Campaign LLC, 1 North Dearborn St., 5th Floor, Chicago, IL 60602. Active Campaign is a service that allows the sending of newsletters to be organized and analyzed. The data you enter to receive the newsletter (e.g. email address) is stored on Active Campaign's servers in the USA.
Our newsletters sent via Active Campaign enable us to analyze the behavior of newsletter recipients (e.g., open rate, click-through rate of links, conversion tracking). Further information on data analysis by Active Campaign newsletters can be found at: https://www.activecampaign.com/legal/privacy-policy
Data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw this consent at any time by unsubscribing from the newsletter.
If you do not want an analysis by Active Campaign, you must unsubscribe from the newsletter. We provide a corresponding link in every newsletter message for this purpose.
Additionally, a tracking snippet from Active Campaign is set up on all of our pages, which transmits information about your user behavior to Active Campaign by setting a cookie. You can object to this data transmission in our cookie banner.
The data you have provided to us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted both from our servers and from the servers of Active Campaign after you unsubscribe. For more details, please refer to the Active Campaign privacy policy at: https://www.activecampaign.com/privacy-policy.
j) Appointment scheduling on the website with Calendly
For scheduling appointments via our website, we use the tool "Calendly" provided by Calendly, LLC, 3423 Piedmont Road NE, Atlanta, GA 30305-1754, United States.
In Calendly, you will be shown available appointments. After selecting an appointment, you will be asked to provide your contact details (name, email address, and phone number). The email address is required to confirm the appointment.
Data processing for the purpose of contacting us is carried out in accordance with Art. 6 Para. 1 Sentence 1 lit. a GDPR on the basis of your voluntarily given consent. The personal data collected by us for the purpose of scheduling an appointment will be automatically deleted after the appointment has taken place and the request you made has been resolved.
If your inquiry is aimed at entering into a contract, Art. 6 para. 1 sentence 1 lit. b) GDPR serves as the legal basis. In this case, we store your data for the duration of the statutory retention periods.
Further information about Calendly and data protection at Calendly can be viewed here: https://calendly.com/pages/privacy.
k) Embedded videos from Vimeo
On some pages of our website we embed videos from the provider Vimeo (Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA). A video is only loaded once you click “Video abspielen” (play video) or have consented to the Vimeo service in the cookie settings. Before that, no data is transferred to Vimeo.
As soon as the video loads, Vimeo receives your IP address and information about your device and browser, and stores cookies on your device to play the video.
The processing is based on your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future, for example via “Cookie settings” in the footer of every page. We cannot delete cookies that Vimeo has already set; you can remove them in your browser.
Data is transferred to the USA in the process. Vimeo is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection within the meaning of Art. 45 GDPR; Standard Contractual Clauses may apply in addition. Further information is available in Vimeo’s privacy policy: https://vimeo.com/legal/privacy/policy.
C. Additional Privacy Policy for the EverReal Platform
1. What additional personal data do we process on the platform?
· General technical personal data regarding the use of the customer portal:
o IP address of the requesting computer,
o date and time of access,
o Internet service provider of the accessing system,
o Subpages that are accessed on the website via an accessing system,
o Website from which the access is made (referrer URL),
o the browser used and its version,
o the operating system of your computer as well as the name of your access provider, and
o other similar data and information that serve to avert danger in the event of attacks on the provider's information technology systems (collectively “customer portal usage data”);
· personal data of the user within the scope of registration for the use of the platform, i.e. username, password and other information provided (“Registration Data”);
· personal login data of yours, i.e. login and hash value of the password (“Login Data”);
· personal data of the user as a prospective tenant, i.e., first and last name, email address, telephone number, calendar, and other personal data voluntarily provided by the user (e.g., age, marital status, number of children, employer, previous landlord, creditworthiness information) (“Prospective Tenant User Data”);
· personal data of the user as an interested party in purchasing a property, i.e., first and last name, email address, telephone number, calendar, and other personal data voluntarily provided by the user (e.g., age, marital status) (“property prospect user data”);
· personal data of the user in connection with an existing private tenancy, i.e. first and last name, email address, telephone number, bank details if a direct debit authorization is granted via the customer portal, calendar, and other personal data voluntarily provided by the user (e.g. age, marital status, number of children, employer, previous landlord) (“Private Tenancy User Data”);
· personal data of the user in connection with an existing commercial tenancy, i.e. contact person, contact details (e.g. email address, address, telephone, fax), payment information, VAT ID (“Commercial Tenancy User Data”);
· personal data of the user in connection with their status as owner, i.e., first and last name, contact person if applicable, contact details (e.g. email address, physical address, telephone, fax), payment information, VAT ID (“Owner User Data”);
· personal data of the user in their capacity as property management companies, asset managers, representatives of property owners, and service providers in connection with real estate, i.e., first and last name, contact person if applicable, contact details (e.g., email address, address, telephone, fax), payment information, VAT ID (“Service Provider User Data”);
· Support data of users within the scope of the platform's services; i.e., the data and error messages arising within the framework of support, data administration, and the fulfillment of data subject rights (e.g., when processing requests for information, correction, and deletion) ("Support Data").
2. For what purposes and on what legal bases do we process personal data?
a) Data processing of platform usage data
When accessing the platform, information is automatically sent to the platform's server by the browser used on your end device. This information is temporarily stored in a so-called log file. The data is collected without your intervention and stored until it is automatically deleted.
The data is processed by us for the following purposes: ensuring a smooth connection setup for the website; ensuring convenient use of the customer portal; evaluating system security and stability; and for further administrative purposes.
The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR, which permits the processing of personal data within the scope of our "legitimate interests", provided that the fundamental rights, fundamental freedoms, or interests of the data subject do not prevail. Our legitimate interest follows from the aforementioned listed purposes for data collection. In no case do we use the collected data for the purpose of drawing conclusions about your person. For further information on the user's right to object in this context, please see the corresponding section.
b) Data processing in connection with the platform's services
In order for us to offer and process the use of the platform and services as described in our Terms and Conditions, and for the user to be able to use them, we require, collect, and process the following personal data:
· the registration data,
· the login details,
· prospective tenant user data,
· the user data of the prospective property buyer,
· the user data Private Rental,
· the Commercial Rental user data,
· the user data ownership
· the user data service providers and
· the support data.
The legal basis for this data processing is Art. 6 para. 1 lit. b) GDPR. The data processing is either necessary for the fulfillment of the user agreement regarding the service relationship or to carry out pre-contractual measures that take place at the user's request.
c) Processing of the prospective tenant user data or the prospective property buyer user data despite the contract not being concluded
If it is established that no contractual relationship will be established with the user as a prospective tenant or with the user as a prospective buyer of a property, the prospective tenant user data or prospective buyer user data will be automatically deleted six (6) months after notification of the rejection decision, provided that no other legitimate interests of the provider prevent such deletion. However, we offer rejected prospective tenants or prospective buyers the option (provided the user has given their corresponding consent) to continue storing and evaluating the following personal data so that the user can be contacted by the respective provider in the event of a vacant property that matches the user's stated interest:
· Tenant applicant user data, or
· User data of prospective property buyers.
The legal basis for this data processing is Art. 6 para. 1 lit. a) GDPR (consent under data protection law for specific purposes). The user can withdraw their consent at any time (see Section 6.1).
d) Processing Technical Analysis Data
We collect and process technical analysis data to analyze and improve the use and usability of the platform as well as the services.
The legal basis for this data processing is Art. 6 para. 1 lit. f) GDPR, which permits the processing of personal data within the framework of our "legitimate interests", provided that the fundamental rights, fundamental freedoms or interests of the data subject do not prevail. Our legitimate interests consist in measuring, analyzing and improving our own offers. For further information on the user's right to object in this context, see under A.
e) Use of support services and chatbots from Intercom
We use support services and chatbots from Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, USA (hereinafter “Intercom”). The help center at help.everreal.co is also operated by Intercom.
Intercom's services are used to communicate with you, in particular to process support inquiries, questions about our products, or technical problems.
Within the framework of using the support services and chatbots, the data you transmit to us in connection with your inquiry will be processed. When making support inquiries or using the chatbots on our pages, please avoid entering sensitive data and only share information with us that is necessary to answer your inquiry. As a rule, your name and email address are processed during an inquiry. If you request a callback, your telephone number will also be processed. In addition, your IP address and log data may be recorded. If you have given us your consent, we also use Intercom's services to analyze and evaluate your website usage. We assume that the data you enter into the chatbot will be used by Intercom for analysis purposes, in particular to improve Intercom's products as well as the response behavior of the chatbots.
The processing and storage of this data takes place on Intercom servers within the European Union.
The legal basis for processing is generally our legitimate interest in responding to your inquiry and in providing individual support when using our products in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR. In this case, your interest in the confidentiality of the data does not outweigh our interest in providing you with the requested support.
If your inquiry is aimed at the conclusion or initiation of a contract, the legal basis for processing the data provided is additionally Art. 6 Para. 1 Sentence 1 lit. b GDPR (performance of (pre-)contractual obligations). The analysis and evaluation of your website usage as well as the analysis of your data to improve Intercom's products are based on your consent in accordance with Art. 6 Para. 1 lit. a GDPR in conjunction with Section 25 Para. 1 TDDDG.
Further information on data processing by Intercom can be found at:
We have concluded the Standard Contractual Clauses with Intercom in accordance with the European Commission's Implementing Decision (EU) 2021/914 of June 4, 2021 on Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 (available at:
Intercom's privacy policy can be found at:
Intercom also participates in the EU-US Data Privacy Framework, which ensures an adequate level of data protection in accordance with Art. 45 GDPR.
3. To whom do we pass data on?
We only pass on the personal data of the data subject to other third parties
· insofar as this is necessary or useful for the provision, performance, execution, and use of the platform or the services,
· as far as consent of the data subject has been granted to us for this,
· insofar as we commission service providers to operate the platform or to provide or process the services, who process personal data on our behalf and in accordance with our instructions, or
· insofar as this is required due to mandatory legal provisions, e.g. towards government agencies.
To the extent necessary, we pass on personal data of the data subject in particular to the following recipients or categories of recipients:
a) Transfer of personal data to service providers
Where applicable, we transfer personal data of the data subject to service providers, insofar as this is necessary or useful for the provision, processing, and use of the platform or the services and/or other services owed by us to you.
The legal basis for this data transfer is Art. 6 para. 1 lit. b) GDPR. This serves to fulfill the user agreement or to carry out pre-contractual measures at the user's request.
b) processors
When operating the platform and providing and processing the services, we partly utilize external technical and other service providers who support us in rendering our services. To the extent necessary, these service providers engaged by us process the personal data of the data subject within the scope of their respective mandate in accordance with our instructions for the purposes stated in this privacy policy. They are contractually obligated to strictly comply with this privacy policy, the applicable statutory data protection regulations, and our instructions (so-called data processors pursuant to Art. 28 GDPR). The same applies to any sub-processors in the event that our processors utilize them with our prior consent.
Processors are used by us in particular to host the customer portal.
c) Data transmission of user data to owners/landlords
The following personal data will be transmitted by us to owners, provided that the provider is not itself the owner of the rental property:
· prospective tenant user data,
· the user data of the prospective property buyer,
· the user data service providers,
· the private rental user data and
· the User Data Commercial Rent.
The legal basis for this data transfer is Art. 6 Para. 1 lit. b) GDPR. This serves to fulfill and execute the rental agreement between the user and the owner/landlord or to carry out pre-contractual measures in this context.
With regard to the aforementioned transfer of data to owners within the framework of an existing tenancy who are not landlords, the legal basis for this data transfer is Art. 6 para. 1 lit. f) GDPR, which permits the processing of personal data within the scope of "legitimate interests", provided that the fundamental rights, fundamental freedoms, or interests of the data subject do not prevail. For further information on the user's right to object in this context, see section A.
d) Data transmission of user data to external service providers at the request of the user
We reserve the right to offer users additional services, provided by ourselves or by third parties, that are related to the services of the platform (e.g., setting up a forwarding order with Deutsche Post AG, telephone and internet connection with Deutsche Telekom AG, etc.). The following personal data of the user will be transmitted by us to these external service providers, provided that the user wishes to use the service and initiates this accordingly:
· First and last name of user,
· Address,
· Contact details, and
· if requested by the user, bank account details.
The legal basis for this data transfer is Art. 6 Para. 1 lit. b) GDPR. This serves to fulfill and execute the service contract between the user and the service provider or to carry out pre-contractual measures in this context.
We reserve the right to enable users to use the services of third-party companies or to redirect them to their websites, which assist in self-disclosure (e.g., by creating a digital applicant portfolio or calculating a score value for the suitability of the interested party with regard to a rental or purchase property). The following personal data of the user will be transmitted by us to these external service providers, provided that the user wishes to make use of the service and initiates this accordingly:
· First and last name of user,
· Phone number, mobile number and email address.
The legal basis for this data transfer is Art. 6 Para. 1 lit. b) GDPR. This serves to fulfill and execute the user agreement between the user and us.
e) Compliance check of sanction lists
We may process your personal data (first name, last name, and date of birth) in advance of a contractual relationship in order to determine, as part of a compliance check, whether you are listed on EU or US sanction lists.
This is done in order to determine suitability as a business partner and to comply with legal obligations to prevent business relationships with business partners named on sanction lists.
The legal basis for the compliance check is the fulfillment of legal obligations in accordance with Art. 6 para. 1 lit. c GDPR. If data is matched against sanction lists from third countries, the legal basis is our legitimate interest due to obligations to identify individuals on sanction lists, to prevent business relationships with them, and thus to avoid sanctions against our company, in accordance with Art. 6 para. 1 lit. f GDPR.
f. Analysis and optimization of our services with Pendo.io
For the analysis and optimization of our services, we use the analysis software of Pendo.io, Inc., 150 Fayetteville St., Suite 1400, Raleigh, NC 27601, USA ("Pendo").
With the software, we can analyze how our services are used, provide tutorials, conduct surveys, and gather user feedback. We use Pendo to improve the user experience and our services.
For these purposes, Pendo processes activity data in connection with the visited websites and subpages, the actions taken on the websites (e.g., the retrieval of features such as filters or clicks on specific buttons), as well as the website from which users reached the visited website.
The legal basis for the processing is our legitimate interest in improving the user experience and our products in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. In this case, your interest in the confidentiality of the data does not outweigh our interest in being able to offer you these improvements.
To the extent necessary to provide Pendo's services, the company may also transfer data outside the EEA. Pendo participates in the EU-US Data Privacy Framework, which ensures an adequate level of data protection within the meaning of Art. 45 GDPR, to the extent data is transferred to the USA. When Pendo transfers data to countries for which the European Commission has not issued an adequacy decision, Pendo ensures that appropriate safeguards have been implemented for the transfer of personal data in accordance with the GDPR, in particular the EU Standard Contractual Clauses, which are available here:
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914.
Pendo's privacy policy can be found here:
https://www.pendo.io/de-de/legal/privacy-policy/
g) Other transmission of user data to external service providers
If arranging an appointment with external third parties (e.g., property management companies or brokers) is necessary for the initiation or conclusion of a lease agreement, or if the landlord commissions services from an external third party in connection with an existing tenancy (e.g., repair/maintenance measures on the rental property), the following personal data of the user will be transmitted by us to these external service providers:
· First and last name of user and
· Contact details.
We reserve the right to offer the processing of deposit guarantees through external service providers and to transfer the following personal data to them:
· First and last name of user and
· Email address.
The legal basis for the aforementioned data transfers is Art. 6 para. 1 lit. b) GDPR. This serves to fulfill and execute the lease agreement or to carry out pre-contractual measures in this context.
The legal basis for the transfer of data to external service providers in connection with scheduling appointments for repair and maintenance measures is Art. 6 para. 1 lit. a) GDPR (consent under data protection law for specific purposes). The user may withdraw their consent at any time.
h) Transmission of the user's contact details to tenants
We share the following personal data of users with current tenants so that they can coordinate a viewing appointment if necessary, provided the user has given their express prior consent:
· First and last name of user and
· Contact details
The legal basis for this data processing is Art. 6 para. 1 lit. a) GDPR (consent under data protection law for specific purposes). The user can withdraw their consent at any time.
i) Data transmission to verify creditworthiness
In connection with the initiation of the tenancy between the interested party and the provider, and the landlord, we transmit the following personal data of the user as a prospective tenant to credit agencies (such as SCHUFA Holding AG, Creditreform Münster Riegel & Riegel KG, Creditreform Boniversum GmbH, or CRIF Bürgel GmbH) for the purpose of creditworthiness checks:
· First and last name of user,
· Address, and
· Date of birth.
The legal basis for these transfers is the consent of the data subject pursuant to Art. 6 (1) (a) GDPR. The user may withdraw their consent at any time.
SCHUFA Holding AG processes the data received and also uses it for the purpose of profile creation (scoring) in order to provide its contractual partners in the European Economic Area and Switzerland, as well as in other third countries (provided there is an adequacy decision by the European Commission for these), with information to assess, among other things, the creditworthiness of natural persons. Further information on SCHUFA's activities can be found in the SCHUFA information sheet pursuant to Art. 14 GDPR or viewed online at www.schufa.de/datenschutz.
j) Data transfer within the scope of the global applicant pool
The following personal data of the user will be transmitted by us to real estate providers as part of the so-called “global applicant pool”, provided that the user has expressly consented to this in advance:
· Tenant applicant user data.
· Prospective buyer user data.
The global applicant pool offers prospective renters and buyers the opportunity to be contacted by other providers as well, provided their profile matches a becoming-vacant property that corresponds to the user's stated interest.
The legal basis for this data processing is Art. 6 para. 1 lit. a) GDPR (consent under data protection law for specific purposes). The user can withdraw their consent at any time.
k) Transfer of personal data to other recipients
There will be no further transfer of the data subject's personal data to other recipients.
Cooperation partners
