Privacy notice

1. Who is responsible for your data

The person responsible for how your personal data is used (the controller) is:
GETS LIVING
Igor Gaeds
Puetzgasse 2, 42719 Solingen, Germany
Telephone: +49 (0) 212 7817 5090
Email: info@getsliving.de

For privacy questions or to exercise your rights, email datenschutz@getsliving.de. This is our contact address for privacy matters.

2. Hosting

This website is hosted by Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The provider states that its data centres are in Germany.

When you open a page, the web server processes the connection data needed to display it. This includes your IP address, the date and time, the page address, the HTTP status and the amount of data transferred. It also includes information your browser sends, such as its type and, where provided, the page you came from. We use this data to deliver the website, investigate technical problems and protect it against attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is running a secure and reliable website. We keep server logs only for as long as needed to investigate technical problems and check security, then delete or anonymise them. After a specific security incident, we may need to keep them longer while we investigate and preserve necessary evidence. We do not use these logs to build advertising profiles.

3. Contact form, email and telephone

When you contact us, we use the details you provide to handle your enquiry and respond. The form requires a subject, name, email address and message. If you are sending property details or introducing a property, you can also add its location, number of residential units and asking price. These extra fields are optional. The form also sends us the language of your enquiry. Emails may contain other information and attachments. For telephone enquiries, we use the contact details and information you share during the call.

Contact form messages are emailed to info@getsliving.de. The form does not save messages in a separate database, but they are processed in the email accounts we use to handle enquiries. We do not use an external form service.

If your enquiry concerns entering into or carrying out a contract with you, the legal basis is Article 6(1)(b) GDPR. For other enquiries, including those made on behalf of a company, it is Article 6(1)(f) GDPR. Our legitimate interest is responding to enquiries and managing business communications. You do not have to provide information. Without the details needed to understand your enquiry and contact you, however, we may be unable to respond.

We delete enquiries once they have been fully dealt with, unless an ongoing business relationship, a legal retention requirement or the need to preserve evidence requires us to keep them. Where statutory retention rules apply, business correspondence must be kept for six years from the end of the relevant calendar year. Supporting accounting documents are generally kept for eight years. Processing required by law is based on Article 6(1)(c) GDPR. Processing needed to establish, exercise or defend legal claims is based on Article 6(1)(f) GDPR.

4. Email communication

We use Google Workspace to manage email correspondence. For customers in Germany, the provider is generally Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. This involves processing sender and recipient details, message contents, attachments and technical delivery information. The hosting provider named in section 2 is also involved in sending contact form messages.

We use these services for the purposes and on the legal bases explained in section 3. Our hosting and email providers process data on our behalf under Article 28 GDPR. Access is limited to the people handling your enquiry and the service providers needed for that work. Sending an enquiry does not automatically share it with potential capital partners or other people involved in a project. We share information with them only where this is needed for your enquiry and there is a legal basis.

Google group companies and subcontractors may process Google Workspace data outside the EU or EEA, particularly in the United States. Transfers to US recipients certified under the EU-US Data Privacy Framework may rely on the adequacy decision under Article 45 GDPR. For transfers not covered by an adequacy decision, Google’s contractual terms provide safeguards, particularly EU standard contractual clauses under Article 46 GDPR. You can find more information and the contractual documents in Google’s Data Processing Addendum and its information on international data transfers. You can also ask us for a copy of the safeguards that apply to your data.

5. Contact form security

To protect the form against forged or abusive requests, we use a server-side session with a cookie called gets_contact. The cookie contains a random session identifier and is restricted to the /api/ form area. It has no fixed expiry date and ends according to your browser’s session settings. The security token is valid for one hour. Session data on the server is removed through the hosting service’s session cleanup process.

We also limit submission attempts within a 15-minute window. A coded identifier (hash) derived from your IP address is stored with request timestamps in the server’s temporary directory. This makes the data pseudonymised, not anonymous. These counters do not contain your messages or your original IP address. Older timestamps are removed when another request is made. Expired counter files are deleted during recurring cleanup runs while the form is in use. The 15-minute window is used to count attempts; it is not a guaranteed deletion deadline for each file.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is preventing spam and attacks. Storing and reading the session cookie needed for the form you requested is based on section 25(2), no. 2 TDDDG.

6. Light and dark mode

The website follows your device’s light or dark setting unless you have saved a manual choice. If you change the mode using the button, your browser saves light or dark in localStorage under gets-living-theme. Your choice stays in place when you switch languages or return using the same browser. It is not sent to us.

The saved choice has no fixed expiry date. You can remove it by clearing this website’s data in your browser. Storing and reading it serves only your chosen display setting and is based on section 25(2), no. 2 TDDDG. Where personal data is processed, the basis is Article 6(1)(f) GDPR. Our legitimate interest is making the website easy to use in your preferred mode.

7. Local content and external links

We do not use analytics or advertising trackers, embedded maps or videos, or fonts loaded from other websites. Images, icons and stylesheets are served from this website. Your choice of language is part of the page address, so we do not set a language cookie.

External websites are opened only when you follow a link. Their own privacy notices apply to any data they process. This website does not carry out profiling or automated decision-making that has legal or similarly significant effects on you under Article 22 GDPR.

8. Your rights

Under the conditions set by law, you can request access to your data (Article 15 GDPR), correction (Article 16), deletion (Article 17), restriction of processing (Article 18) and data portability (Article 20). If processing is based on your consent, you can withdraw that consent at any time. Withdrawal applies to future processing and does not affect the lawfulness of processing before you withdrew it.

• Right to object: If we process data under Article 6(1)(f) GDPR, you can object under Article 21 GDPR for reasons relating to your particular situation. We will stop processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need to process the data for legal claims. You can object to direct marketing at any time without giving reasons.

Email datenschutz@getsliving.de or use the contact details above. You do not need a customer account. We normally respond within one month and will tell you if the law allows us more time.

9. Right to complain

Under Article 77 GDPR, you can complain to a data protection supervisory authority, particularly where you usually live or work, or where the suspected breach took place. In North Rhine-Westphalia, the authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen. You can contact it at Postfach 20 04 44, 40102 Düsseldorf, Germany, by telephone on +49 (0) 211 38424-0, or by email at poststelle@ldi.nrw.de. A complaint form is available on its website. You do not have to contact us before making a complaint.

10. Security and changes

The website is served over encrypted HTTPS. Emails are not automatically end-to-end encrypted. Please contact us before sending particularly sensitive documents. We update this notice when our services, the way we process data or legal requirements change.