2. What Personal Data We Collect

We may collect and process the following categories of personal data, depending on how you interact with us:

a. Identity and Contact Data

Name, email address, phone number, postal address, company name, job title, and other contact details you provide.

b. Account and Profile Data

Login details, account preferences, profile information, verification data, and information submitted when creating or using an account.

c. Communication Data

Information you provide when contacting us by email, contact form, live chat, support request, or other communication channels.

d. Transaction and Contract Data

Information relating to property interest, bookings, investments, onboarding, payments, billing, contractual communication, or other commercial interactions, where applicable.

e. Technical and Usage Data

IP address, browser type, operating system, device information, referral URLs, pages viewed, timestamps, usage patterns, and interaction data.

f. Marketing Data

Newsletter preferences, consent choices, campaign interactions, and lead source information.

g. Compliance and Verification Data

Where required by law or for legitimate business purposes, we may process identity, fraud prevention, AML, KYC, sanctions screening, or risk-related data.

3. How We Collect Personal Data

We collect personal data:

• directly from you when you fill in forms, contact us, register, request information, or use our Services,

• automatically through cookies and similar technologies when you use our website,

• from service providers, business partners, analytics providers, or public sources where legally permitted,

• during pre-contractual steps, customer onboarding, or compliance checks where relevant.

4. Purposes of Processing and Legal Bases

We process personal data only where we have a valid legal basis under Article 6 GDPR. The legal basis depends on the purpose of processing. Consent must meet GDPR requirements, and legitimate interest requires a proper balancing test. 

We may process personal data for the following purposes:

a. To provide and operate our Services

Including website functionality, account access, platform use, security, administration, and technical delivery.

Legal basis:

• Article 6(1)(b) GDPR — performance of a contract or pre-contractual steps

• Article 6(1)(f) GDPR — legitimate interests in operating and securing our Services

b. To respond to inquiries and communicate with you

Including replies to contact form submissions, email inquiries, meeting requests, and customer support. German regulatory examples confirm that contact form processing typically involves identity/contact data and message content for handling the request. 

Legal basis:

• Article 6(1)(b) GDPR — pre-contractual measures

• Article 6(1)(f) GDPR — legitimate interests in communication and business operations

c. To manage customer, investor, partner, or supplier relationships

Including onboarding, due diligence, service delivery, administration, invoicing, and contract management.

Legal basis:

• Article 6(1)(b) GDPR

• Article 6(1)(c) GDPR — legal obligation

• Article 6(1)(f) GDPR

d. To improve our website, platform, and user experience

Including analytics, performance measurement, debugging, service optimization, and internal reporting.

Legal basis:

• Article 6(1)(a) GDPR — consent, where required

• Article 6(1)(f) GDPR — legitimate interests, where lawful

e. To send marketing communications

Including newsletters, updates, event invitations, or relevant offers, where permitted by law.

Legal basis:

• Article 6(1)(a) GDPR — consent

• Article 6(1)(f) GDPR — legitimate interests, where direct marketing is lawful under applicable law

f. To comply with legal and regulatory obligations

Including accounting, tax, fraud prevention, AML/KYC, sanctions screening, recordkeeping, dispute handling, and law enforcement requests.

Legal basis:

• Article 6(1)(c) GDPR

• Article 6(1)(f) GDPR

g. To establish, exercise, or defend legal claims

Including dispute resolution, enforcement, legal advice, and evidence preservation.

Legal basis:

• Article 6(1)(f) GDPR

5. Cookies and Similar Technologies

We use cookies and similar technologies on our website. Some cookies are strictly necessary, while others require your consent under applicable law. More information is set out in our Cookie Policy. EU guidance states that non-essential cookies generally require prior consent and that information must be clear and transparent. 

6. If You Fail to Provide Personal Data

Where we need personal data by law or under a contract, and you do not provide it, we may not be able to enter into or perform a contract with you, respond fully to your request, or provide parts of our Services.

7. Recipients of Personal Data

We may share personal data with the following categories of recipients where necessary:

• hosting and infrastructure providers,

• IT, cloud, and software providers,

• analytics and marketing providers,

• payment service providers,

• CRM, communication, and support providers,

• legal, tax, accounting, and compliance advisors,

• identity verification, AML, fraud prevention, and risk screening providers,

• courts, regulators, supervisory authorities, or law enforcement where required,

• affiliated entities and business partners where necessary for legitimate business operations.

We only share personal data to the extent necessary and subject to appropriate contractual and legal safeguards.

7A. Hosting, Infrastructure and Server Log Files

When you visit our website, certain information is processed automatically in server log files in order to ensure the technical operation, stability, and security of the website. This may include the IP address, date and time of access, requested pages or files, browser type, operating system, referrer URL, HTTP status code, and similar technical information.

This processing is carried out for the purpose of providing the website, maintaining system security, preventing misuse, and ensuring the stability of our Services.

Legal basis: Article 6(1)(f) GDPR — legitimate interests in the secure and reliable provision of our website and digital services. The GDPR requires transparency and data minimisation, so only data necessary for these purposes should be processed. 

7B. Consent Management Platform

We use a consent management tool to document and manage your cookie and tracking preferences. This allows us to store your consent status, preferences, time of consent, and related technical signals in order to demonstrate compliance with applicable data protection and ePrivacy requirements.

Legal basis:

• Article 6(1)(c) GDPR — compliance with legal obligations, where applicable

• Article 6(1)(f) GDPR — legitimate interests in documenting user preferences and compliance

• Article 6(1)(a) GDPR — consent, where processing depends on your consent

Under EU rules, non-essential cookies generally require prior consent and should not be placed before the user has made a valid choice. 

7C. Google Tag Manager

We may use Google Tag Manager, a tag management system provided by Google, to manage website tags through a central interface. Google Tag Manager itself is generally used to load and control other tags and scripts. Those tags may in turn collect data if activated.

Where Google Tag Manager is used only to technically manage scripts, the processing is carried out for efficient website administration. Where tags loaded through Google Tag Manager process personal data or use non-essential cookies, such processing takes place only on the basis applicable to the underlying tool, in particular your consent where required.

Legal basis:

• Article 6(1)(f) GDPR — legitimate interests in efficient website management

• Article 6(1)(a) GDPR — consent, where non-essential tags are activated

7D. Google Analytics

We may use Google Analytics to analyse the use of our website and better understand visitor behaviour, traffic sources, page performance, and interactions with content. Google states that Analytics offers controls over advertising features and consent-related settings, and GA4 allows website operators to configure cookie behaviour and retention-related settings. 

Google Analytics may process information such as IP-related technical information, device and browser data, pages viewed, session statistics, approximate geolocation, and interaction data.

Where Google Analytics is used with cookies or identifiers that are not strictly necessary, it is activated only after your consent has been obtained through our consent tool.

Legal basis: Article 6(1)(a) GDPR — consent.

7E. Google Ads and Conversion Tracking

We may use Google Ads, including conversion tracking and remarketing features, to measure the effectiveness of our advertising campaigns and show relevant advertising to users who have previously visited our website.

Google explains that it uses cookies and similar technologies for advertising-related purposes, and Google Analytics advertising features may involve advertising cookies and identifiers in addition to standard analytics data. 

This may involve the processing of information such as page visits, device/browser information, ad interactions, conversion events, and audience-related signals.

Where legally required, these technologies are only used after you have given your prior consent.

Legal basis: Article 6(1)(a) GDPR — consent.

7F. Google Maps

We may embed Google Maps in order to display interactive maps and geographic information on our website. When such content is loaded, Google may receive technical information such as your IP address and information about your use of the relevant map feature.

If Google Maps is embedded in a way that involves non-essential data processing or third-party cookies, the content is only activated after the required consent has been obtained.

Legal basis:

• Article 6(1)(a) GDPR — consent, where required

• Article 6(1)(f) GDPR — legitimate interests in presenting location-based information, where lawful

7G. YouTube and Video Embeds

We may embed videos from YouTube or similar video platforms on our website. When such embedded content is loaded or played, the relevant provider may process technical usage data and may place cookies or similar technologies on your device.

Where required by law, embedded videos that involve non-essential cookies or third-party data processing are only activated after you provide consent.

Legal basis: Article 6(1)(a) GDPR — consent.

7H. Google reCAPTCHA

We may use Google reCAPTCHA or similar anti-bot technology to protect our website, forms, and services against abuse, automated access, and spam.

This may involve the processing of IP address, browser and device information, usage behaviour, and technical interaction data in order to distinguish between legitimate users and abusive traffic.

Legal basis: Article 6(1)(f) GDPR — legitimate interests in website security, fraud prevention, and protection against misuse.

7I. Meta Pixel

We may use the Meta Pixel provided by Meta Platforms to measure the effectiveness of our advertising, track user actions on our website, create audiences, and support remarketing and ad optimisation. Meta describes the Pixel as JavaScript code used to track visitor activity on a website, and its business documentation explains that it can be used to measure actions, build audiences, and optimise campaigns. Meta also provides cookie settings for Pixel implementations. 

The processed information may include page views, device/browser data, referrer information, actions taken on the website, and conversion-related events.

Where legally required, the Meta Pixel is used only after your prior consent.

Legal basis: Article 6(1)(a) GDPR — consent.

7J. LinkedIn Insight Tag

We may use the LinkedIn Insight Tag to track conversions, generate reports on website visitors, and create retargeting audiences for LinkedIn advertising. LinkedIn describes the Insight Tag as lightweight JavaScript code used for conversion tracking, website retargeting, and campaign reporting, and LinkedIn’s cookie materials explain that related cookies may be set on third-party sites where the Insight Tag is installed. 

The processed information may include URL, referrer URL, IP address in shortened or hashed form where applicable, device and browser characteristics, and timestamp and event data.

Where legally required, the LinkedIn Insight Tag is only activated after your prior consent.

Legal basis: Article 6(1)(a) GDPR — consent.

7K. Social Media Presence

We maintain business profiles on social media platforms such as Instagram, Facebook, LinkedIn, X, or similar channels in order to present our company, communicate with users, publish updates, and market our services.

When you visit our social media pages or interact with us there, personal data may be processed both by us and by the relevant platform provider. We have no full control over all data processing operations carried out by those providers. Additional information is available in the privacy notices of the relevant platform providers.

Legal basis: Article 6(1)(f) GDPR — legitimate interests in public communication, visibility, and brand presence.

7L. Contact Forms, Lead Forms and Communication Requests

If you contact us via a contact form, inquiry form, booking form, or lead form, we process the data you provide in order to handle your request, respond to inquiries, and, where relevant, initiate pre-contractual measures.

This may include your name, email address, phone number, company details, subject matter, property-related interest, and message content.

Legal basis:

• Article 6(1)(b) GDPR — pre-contractual measures

• Article 6(1)(f) GDPR — legitimate interests in handling business inquiries

7M. CRM, Sales and Customer Management Tools

We may use CRM and communication tools, such as systems for managing inquiries, leads, customer communications, appointments, or relationship history. These tools may process contact details, communication history, inquiry status, notes, and commercial interactions.

Legal basis:

• Article 6(1)(b) GDPR — contract or pre-contractual measures

• Article 6(1)(f) GDPR — legitimate interests in structured customer and lead management

If such a tool is provided by a third party outside the EEA, we will ensure that appropriate transfer safeguards are in place where required.

7N. Newsletter and Email Marketing

If you subscribe to our newsletter or marketing updates, we process your contact details and subscription preferences in order to send you news, updates, product information, event invitations, or company-related communications.

Where required, newsletter registration is carried out using a confirmation process to verify your subscription.

We may also measure whether newsletters are opened and which links are clicked, where legally permitted and properly disclosed.

Legal basis: Article 6(1)(a) GDPR — consent.

You can withdraw your consent and unsubscribe at any time with effect for the future.

7O. Appointment Booking Tools

We may use booking and scheduling tools to allow users to arrange calls, meetings, demos, or appointments with us. In this context, we may process name, email address, availability details, company information, and any information you provide in the booking form.

Legal basis:

• Article 6(1)(b) GDPR — pre-contractual measures

• Article 6(1)(f) GDPR — legitimate interests in efficient scheduling and communication

7P. Payment Service Providers

Where payments are offered through our Services, we may use third-party payment providers to process transactions securely. In that case, payment-related data may be processed directly by the payment provider, including billing details, transaction reference, payment status, and anti-fraud information.

Legal basis:

• Article 6(1)(b) GDPR — performance of a contract

• Article 6(1)(c) GDPR — legal obligations

• Article 6(1)(f) GDPR — legitimate interests in secure payment processing

7Q. International Transfers

Some of the third-party providers named above may process personal data outside the European Economic Area. Where that occurs, we will ensure that the transfer is subject to appropriate safeguards, such as an adequacy decision or approved contractual mechanisms, as required by applicable law. The European Commission expressly requires transparency about whether data is transferred outside the EU.

8. International Data Transfers

Some recipients may process personal data outside the European Economic Area. Where this happens, we will ensure that appropriate safeguards are in place, such as:

• an adequacy decision by the European Commission, or

• standard contractual clauses or other lawful transfer mechanisms.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including for legal, regulatory, tax, accounting, contractual, and evidentiary requirements.

Retention periods may vary depending on the type of data and purpose of processing. In general:

• inquiry data is retained as long as necessary to handle the request and any follow-up,

• contract and transaction data is retained for the duration of the relationship and applicable statutory retention periods,

• marketing data is retained until consent is withdrawn or the data is no longer needed,

• technical logs are retained for a limited period necessary for security and system integrity,

• compliance-related data may be retained as required by law.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. The GDPR is technology-neutral and applies regardless of the storage medium or processing method. 

These measures may include access controls, encryption, authentication procedures, logging, role-based permissions, backup processes, vendor due diligence, and internal confidentiality obligations.

11. Your Rights

Under the GDPR, you may have the following rights, subject to legal limitations:

• the right to access your personal data,

• the right to rectification,

• the right to erasure,

• the right to restriction of processing,

• the right to data portability,

• the right to object to processing,

• the right to withdraw consent at any time, where processing is based on consent,

• the right not to be subject to certain automated decisions, where applicable,

• the right to lodge a complaint with a competent supervisory authority.

The European Commission and EDPB both emphasize that individuals must be informed of these rights in a clear and accessible way, and German authorities note that individuals may complain to a competent supervisory authority if they believe processing violates the GDPR. 

To exercise your rights, please contact us at:

info@home-x.com

12. Right to Object

Where we process your personal data on the basis of legitimate interests, you have the right to object to such processing on grounds relating to your particular situation, subject to applicable law.

Where we process your personal data for direct marketing purposes, you have the right to object at any time to such processing.

13. Withdrawal of Consent

If we process your personal data on the basis of consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

14. Automated Decision-Making

As a rule, we do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, unless this is explicitly stated, legally permitted, and accompanied by appropriate safeguards.

If such processing is used in specific cases, we will provide additional information as required by law.

15. Third-Party Links

Our website or Services may contain links to third-party websites, tools, or services. We are not responsible for the privacy practices of third parties. We encourage you to review their privacy notices separately.

16. Children

Our Services are not directed to children, and we do not knowingly collect personal data from children without appropriate legal basis or authorization, where required.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or business developments. If we make changes, we will update the “Last Updated” date at the top of this Privacy Policy.

18. Contact

If you have questions about this Privacy Policy or our handling of personal data, please contact:

RL Holding 2023 GmbH

Fritschestraße 79

10585 Berlin

Germany

Commercial Register: HRB 279572 B

Register Court: Amtsgericht Charlottenburg

Commercial Register Department: Abteilung B

Email: info(@) home-x.com