Privacy Policy - Privacy on rehtg.com

1. Controller

The controller is reHeritage GmbH, c/o Margherita Natalini, Schröderstraße 4, 10115 Berlin, Germany, represented by its managing director Margherita Natalini. E-mail: margherita.natalini@rehtg.com, phone: +49 157 73601630.

We have not appointed a data protection officer because we are not legally required to. For any privacy question, please use the contact details above.

2. In short

• The public part of the website sets no cookies, uses no analytics or tracking tools and loads no third-party content – no external fonts, maps, videos or social media plugins.
• There is no contact form. You can reach us by e-mail or phone.
• Only the protected client area, which we provide to invited clients and prospective buyers, sets strictly necessary cookies and keeps an access log.

3. Hosting and server log files

Our website is hosted by Vercel Inc. (USA) and delivered from a data centre in Frankfurt am Main. With every request, Vercel automatically processes the technical data your browser sends:

• IP address
• date and time of the request
• page or file requested
• previously visited page (referrer), if sent
• browser, operating system and device type (user agent)
• status code and amount of data transferred

This data is needed to deliver the website, keep it stable and secure, and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of the website. We do not use this data for marketing or audience measurement and do not combine it with other data. Vercel keeps the logs only briefly and then deletes them automatically.

Vercel processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. For transfers to the USA, see section 8.

4. Contacting us by e-mail or phone

When you contact us by e-mail or phone, we process the data you give us – such as your name, e-mail address, phone number and the content of your enquiry – to answer it and, where applicable, to prepare and carry out a brokerage or other assignment. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

E-mails to addresses at rehtg.com are delivered through the forwarding service ImprovMX to our mailboxes at Google (Gmail) and stored there.

We delete enquiries once they have been dealt with, unless statutory retention duties apply. Business correspondence and contract-related documents are kept for the retention periods required by German commercial and tax law (in particular § 257 HGB, § 147 AO).

5. Protected client area (data room)

For certain projects, in particular properties marketed under a sales mandate, we provide a protected area that only people we have invited can access. You sign in without a password, through a link we send you by e-mail. We process:

• Access data: e-mail address, name (if provided), the projects and access level granted to you, and internal notes on how the contact came about.
• Confidentiality acceptance: the time you accepted a project's confidentiality terms, with IP address and user agent as evidence. We receive an internal e-mail notification of the acceptance.
• Access log: sign-ins, project pages and properties viewed, documents downloaded and changes to access rights, each with time, IP address and user agent.

The purpose is to make confidential documents available only to authorised people, to be able to prove compliance with the confidentiality agreement, and to document the marketing for our principals. The legal bases are Art. 6(1)(b) GDPR (pre-contractual steps and the confidentiality agreement) and Art. 6(1)(f) GDPR (legitimate interest in the security of the data room and in evidencing confidentiality).

We use the following processors: Vercel (USA) for hosting and storing the documents, Neon (USA) for the database, and Resend (USA) for sending sign-in and notification e-mails. The website, database and documents are run in data centres in Frankfurt am Main.

We keep your access data for as long as you have access to the project. After the project ends, we delete your access and the access log unless we need them to establish, exercise or defend legal claims – for example under the confidentiality agreement or to evidence a commission claim – or statutory retention duties apply.

6. Cookies

The public part of our website sets no cookies. In the protected client area we only use strictly necessary cookies, without which signing in would not work:

• __Host-next-auth.csrf-token – protects the sign-in process against cross-site request forgery; deleted when you close the browser.
• __Secure-next-auth.callback-url – remembers which page to return you to after signing in; deleted when you close the browser.
• __Secure-next-auth.session-token – keeps you signed in; valid for up to 30 days after your last visit or until you sign out.

These cookies do not require consent (§ 25 Abs. 2 Nr. 2 TDDDG). The related processing is based on Art. 6(1)(b) and (f) GDPR. We do not use cookies for analytics, advertising or tracking.

7. Sharing of data

We only share your data as described in this policy, where it is necessary to perform a contract – for example passing a prospective buyer's contact details to the owner of a property as part of the brokerage –, where you have consented, or where we are legally required to. We do not sell data or use it for third-party advertising.

8. Transfers to third countries

Vercel, Neon and Resend are based in the USA. Although the website, the client-area database and the documents are stored and processed in Frankfurt am Main, sending e-mails through Resend and access by the providers, for example for maintenance and support, may amount to a transfer to the USA. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise it is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of the respective data processing agreements.

9. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, simply e-mail margherita.natalini@rehtg.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.

10. Obligation to provide data and automated decisions

You are not obliged to provide personal data. Without an e-mail address, however, we cannot give you access to the client area. We do not use automated decision-making, including profiling (Art. 22 GDPR).

11. Security

The website is delivered only over encrypted HTTPS connections. Client-area documents are not publicly accessible and are made available only to authorised people.

12. Changes

We update this privacy policy when our website or the law changes. The version published on this page applies.