Privacy Policy
Translation for convenience. The German version of this Privacy Policy is the legally binding one; in the event of any discrepancy, the German text prevails.
Controller
The controller within the meaning of the General Data Protection Regulation and other data protection provisions is:
EBRO Immobilien GmbH
Karolinenstraße 4
80538 Munich
Germany
Telephone: +49 89 24 22 64-0
Email: info@ebro-immobilien.de
General Information on Data Processing
We process personal data only to the extent necessary to provide our website, to handle enquiries, to initiate or perform contractual relationships, to comply with legal obligations or to protect legitimate interests.
Personal data means all information relating to an identified or identifiable natural person. This includes, for example, name, contact details, IP address, communication content and information about the use of our website.
Processing is carried out in particular on the following legal bases:
Art. 6 (1) (a) GDPR where consent has been given
Art. 6 (1) (b) GDPR for the performance of a contract or pre-contractual measures
Art. 6 (1) (c) GDPR for compliance with legal obligations
Art. 6 (1) (f) GDPR for the protection of legitimate interests
§ 25 (1) TDDDG for access to terminal equipment requiring consent
§ 25 (2) TDDDG for strictly technically necessary access to terminal equipment
Hosting and Server Log Files
Our website is hosted by the following service provider:
Skyfillers GmbH
Schiffbrücke 66
24939 Flensburg
When you access our website, your browser automatically transmits information to the server of our hosting provider. The following data in particular may be processed:
IP address
date and time of access
page or file accessed
previously visited website
browser type and browser version
operating system used
host name of the accessing device
volume of data transferred
HTTP status code
This processing is carried out in order to provide the website technically, to ensure its stability and security, to detect technical faults and to prevent abusive access.
The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of our website.
Server log files are generally stored only for as long as is necessary for the purposes stated. Longer storage may occur where there are specific indications of unlawful use, a security incident or another disruption.
Where necessary, a data processing agreement has been concluded with the hosting provider.
Encrypted Data Transmission
This website uses SSL or TLS encryption. This is intended to protect transmitted content against unauthorised access by third parties.
You can recognise an encrypted connection in particular by the “https://” prefix in your browser’s address bar.
Cookies and Similar Technologies
Our website uses cookies and comparable technologies. Cookies are small pieces of information that can be stored on, or read from, your terminal device.
Technically Necessary Technologies
Technically necessary technologies are used to enable basic website functions, security, navigation and the storage of your privacy settings.
Processing is carried out on the basis of § 25 (2) TDDDG and, where personal data is processed, on the basis of Art. 6 (1) (f) GDPR.
Our legitimate interest lies in providing the website in a technically faultless and secure manner.
Technologies Requiring Consent
Technologies that are not technically necessary, in particular for statistics, reach measurement or external media, are used only with your express consent.
The legal bases are § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
You may change or withdraw consent you have given at any time with effect for the future via the “Cookie settings” link in the footer of our website.
The lawfulness of processing carried out up to the point of withdrawal remains unaffected.
Contacting Us by Email, Telephone or Post
If you contact us by email, telephone or post, we process the data you provide in order to handle your enquiry and any follow-up questions.
The following data in particular may be processed:
name
contact details
content and time of your enquiry
information about properties or search requirements
other details provided voluntarily
If your enquiry relates to an existing contract or to pre-contractual measures, processing is carried out on the basis of Art. 6 (1) (b) GDPR.
For general enquiries, processing is carried out on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in handling incoming communication appropriately.
Where you have given express consent, processing is carried out on the basis of Art. 6 (1) (a) GDPR.
The data is deleted as soon as it is no longer required for processing and no statutory retention obligations or other legitimate grounds for further storage exist.
Contact and Enquiry Forms
You can contact us via forms on our website. In doing so, we process the data entered in the respective form fields.
Depending on the form, this may include in particular:
salutation
first name and surname
email address
telephone number
address
type of enquiry
details of the property offered or sought
message text
time of submission
technical connection data
Mandatory fields are marked as such. Other details are provided voluntarily.
Processing is carried out in order to handle your enquiry, to make contact and, where applicable, to prepare a brokerage, purchase, tenancy or other contractual relationship.
The legal basis is Art. 6 (1) (b) GDPR where your enquiry is directed at initiating or performing a contract. For other enquiries, the legal basis is Art. 6 (1) (f) GDPR.
Our legitimate interest lies in handling enquiries in a structured and efficient manner.
Separate consent is required only if data is to be used for purposes going beyond this.
Property Enquiries and Prospective Client Management
If you enquire about a property, submit a search request or register for off-market offers, we process your details in order to handle the specific matter and to broker suitable properties.
The following may be processed in particular:
master data and contact details
search criteria and preferred locations
price expectations and budget range
details of financing status or purchase intention
notes on conversations and communication
viewing information
details of properties enquired about
records of estate agent contacts and knowledge of properties
The legal basis is Art. 6 (1) (b) GDPR. Where processing is necessary for documentation, legal defence or to avoid duplicate property contacts, it may additionally be based on Art. 6 (1) (f) GDPR.
Owner and Sales Enquiries
If you contact us with a view to selling or letting a property, we process the details you provide in order to review and handle your enquiry.
This may include in particular:
name and contact details
location and address of the property
property type and property data
ownership and representation arrangements
floor plans, photographs and documents
price expectations
details of condition and use
communication and advisory history
The legal basis is Art. 6 (1) (b) GDPR. For general enquiries or the documentation of business contacts, Art. 6 (1) (f) GDPR may apply.
Recipients of Data
Within our company, personal data is made accessible only to those persons who require it in order to perform their duties.
In addition, data may be transmitted, where necessary, to the following categories of recipient:
hosting and IT service providers
website and system administrators
CRM and estate agency software providers
email and communication service providers
owners, sellers or landlords
prospective buyers or tenants
notaries, lawyers, tax advisors and auditors
architects, project developers and project participants
authorities and courts
other service providers, where this is necessary for the performance of a contract
Data is disclosed only where there is a valid legal basis, a legal obligation, a contractual necessity or corresponding consent.
Newsletter
If you subscribe to our newsletter, we process your email address and, where applicable, your name in order to send you selected property offers, company information and market information.
Registration takes place using the double opt-in procedure. After registering, you will receive an email in which you must confirm your registration.
To document your consent, the following data in particular may be stored:
email address
time of registration
time of confirmation
IP address at registration and confirmation
registration text used
The legal basis is Art. 6 (1) (a) GDPR.
You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter or by sending a message to info@ebro-immobilien.de.
For sending the newsletter we use:
CleverReach GmbH & Co. KG
Schafjückenweg 2
26180 Rastede
Where necessary, a data processing agreement has been concluded with the provider.
Your newsletter data is stored until you unsubscribe or withdraw your consent. After you unsubscribe, your email address may be stored on a blocklist in order to prevent further mailings and to be able to demonstrate the withdrawal.
Job Applications
If you apply to us, we process the personal data submitted as part of your application.
This may include in particular:
name and contact details
curriculum vitae
references and evidence of qualifications
career history
application photograph
salary expectations
availability
content of communications and interviews
Processing is carried out in order to conduct the application procedure on the basis of § 26 (1) of the German Federal Data Protection Act in conjunction with Art. 6 (1) (b) GDPR.
If no employment relationship comes about, application data is generally deleted no later than six months after completion of the application procedure, unless longer storage is required due to a legal dispute, statutory obligations or separate consent.
Inclusion in an applicant pool takes place only with your express consent.
Google Maps
This website uses Google Maps to display our location and, where applicable, further geographical information.
The provider for users in the European Economic Area is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Maps is loaded only once you have expressly consented to the “External media” category or to the use of Google Maps.
The legal bases are § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
When the map is loaded, the following data in particular may be transmitted to Google:
IP address
browser and device information
date and time of access
referrer URL
interactions with the map
where applicable, location information
where applicable, Google account information if you are logged in to Google
Google may store information in cookies or comparable technologies on your terminal device, or read such information from it.
Processing of data by companies in the Google group outside the European Economic Area, in particular in the USA, cannot be ruled out.
According to its own information, Google bases such transfers on applicable data protection safeguards, for example an adequacy decision or standard contractual clauses.
Your consent is voluntary and can be withdrawn at any time with effect for the future via the cookie settings. Without consent, the map is not loaded.
Social Media Links
Our website contains links to our profiles on Instagram and LinkedIn.
With simple links, a connection to the respective provider is established only when you click on the corresponding link.
Responsibility for the subsequent processing of personal data generally lies with the respective platform operator.
Providers may include in particular:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
Ireland
LinkedIn Ireland Unlimited Company
Wilton Plaza
Wilton Place
Dublin 2
Ireland
When using these platforms, personal data may also be processed outside the European Economic Area.
Transfers to Third Countries
Where personal data is transferred to recipients outside the European Union or the European Economic Area, this takes place only in compliance with the statutory requirements.
The following in particular may serve as a basis for such transfers:
an adequacy decision of the European Commission
certification of a recipient under the EU-US Data Privacy Framework
standard contractual clauses approved by the European Commission
express consent
exceptions provided for by law
Despite appropriate safeguards, in the case of transfers to certain third countries it cannot be entirely ruled out that authorities may access personal data and that only limited legal remedies are available to data subjects.
Storage Period
We store personal data only for as long as is necessary for the respective processing purpose.
Longer storage takes place in particular where statutory retention obligations exist, where data is required to assert, exercise or defend legal claims, where consent permits longer storage, or where an existing contractual relationship requires it.
Once the processing purpose no longer applies, personal data is deleted or blocked, unless there are statutory or legitimate grounds for further storage.
Your Rights
Subject to the statutory requirements, you have in particular the following rights:
right of access under Art. 15 GDPR
right to rectification under Art. 16 GDPR
right to erasure under Art. 17 GDPR
right to restriction of processing under Art. 18 GDPR
right to data portability under Art. 20 GDPR
right to object under Art. 21 GDPR
right to withdraw consent given
right to lodge a complaint with a data protection supervisory authority
Withdrawal of Consent
You may withdraw consent you have given at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing carried out on the basis of the consent up to the point of withdrawal.
You can change or withdraw consent to cookies, statistics services and external media via the cookie settings.
Right to Object
Where personal data is processed on the basis of Art. 6 (1) (e) or (f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.
We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
Where personal data is processed for the purposes of direct marketing, you have the right to object at any time to processing for that purpose.
Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.
The authority generally responsible for private companies based in Bavaria is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht).
You may also contact a data protection supervisory authority at your habitual residence, your place of work or the place of the alleged infringement.
Obligation to Provide Data
The provision of personal data is generally voluntary.
However, certain details may be necessary in order to handle an enquiry, to initiate a contract or to perform a contract. Without these details, it may not be possible to provide the service in question.
Automated Decision-Making
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
Updates to This Privacy Policy
We reserve the right to amend this privacy policy if legal requirements, technical functions or the services used change.
Version: August 2026