Skip to content
Carat Immobilien
Carat Immobilien
Book a consultation
+49 89 6200936-0office@carat.immoInstagramopens in a new tab

Privacy policy

This English translation is provided for convenience only. The German version is the legally binding version.

Last updated: 29 September 2026

1. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
carat Immobilien GmbH
Südliche Münchner Straße 60
82031 Grünwald
Germany
Phone: +49 89 6200936-0
Email: office@carat.immo

2. The essentials at a glance

This website is deliberately built around data minimisation: by default it uses no cookies and no user-level tracking. For reach measurement we rely solely on cookieless, aggregated statistics without user profiles (see section 4). Fonts and all other assets are served from our own servers. We only process personal data where this is necessary to operate the website or to handle your enquiries — or where you explicitly consent (waiting list for upcoming locations, see section 7; Google Maps, see section 8; 360° tour, see section 9).

3. Hosting (Vercel) and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA ("Vercel"). It is served from an EU server region (Frankfurt am Main, "fra1"). We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. As Vercel is based in the USA, access from a third country cannot be fully excluded; for such transfers Vercel is certified under the EU-US Data Privacy Framework, supplemented by the EU Standard Contractual Clauses (Art. 46 GDPR).

When you visit the website, technically necessary connection data are processed automatically (IP address, date and time of access, page requested, browser and operating-system information). These server logs are used to ensure reliable operation, to analyse errors and to defend against attacks, and are deleted after a short period. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in the secure and stable operation of the website).

4. Reach measurement (Vercel Web Analytics)

To evaluate the use of our website statistically, we use Vercel Web Analytics, a feature of our hosting provider Vercel (see section 3). The service works without cookies and does not access information on your device: no identifiers are stored in or read from your browser, and no user profiles are created. Only aggregated statistics are collected, such as page views, the referring page, country, browser and device type, and counted events such as the submission of a form — without its content. To distinguish individual visits, only a short-lived hash value calculated from the request is used, which does not allow recognition beyond the visit.

As no cookies are set and no information is stored on or read from your device, consent pursuant to § 25 (1) of the German TDDDG is not required. The legal basis for the processing is Art. 6 (1)(f) GDPR (legitimate interest in the needs-based improvement of our online offering). Vercel acts as our processor in its capacity as hosting provider (data processing agreement pursuant to Art. 28 GDPR, see section 3); any transfers to the USA are covered by a certification under the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses (Art. 46 GDPR).

5. Database (Neon)

This website does not use a database in regular operation. A PostgreSQL database provided by Neon (neon.com), server location Frankfurt am Main (EU), remains from a previous version of the website; until its final decommissioning it holds legacy records only and is no longer written to. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Enquiry data submitted through the forms on this website are not stored there (see section 6).

6. Email delivery and contact management (Brevo)

We use the service Brevo, operated by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (brevo.com), to send transactional emails (forwarding your enquiry to our team, delivering requested exposés, the confirmation email for the waiting list) and to manage the contact data submitted through our forms. Processing takes place on servers within the EU. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

Your details are stored as a contact in Brevo's contact management (CRM); section 7 sets out which data these are and how long they are kept.

7. Contact forms, exposé requests and waiting list

When you contact us through a form or request an exposé, we process the following data: first and last name, email address, phone number (optional; so that we can promptly arrange follow-up questions and viewings with you), your message, the property or project your enquiry relates to and — where the form asks for it and you choose to provide it — your budget range and time frame. As proof of your consent we additionally store the time it was given and the version of the consent text you saw, as well as the page the enquiry was sent from and the language of the submission.

The purpose of the processing is to handle and answer your enquiry, including sending you the requested exposé. Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures taken at your request) and, beyond that, Art. 6 (1)(f) GDPR (legitimate interest in answering enquiries).

We need the details marked as required fields to process your enquiry; without them the form cannot be sent. You are under no statutory or contractual obligation to provide this data.

Your details reach our office as an email and are stored as a contact at Brevo at the same time (see section 6); this website does not store them anywhere else. Our mailboxes are operated by Microsoft (Microsoft Ireland Operations Limited, Dublin, Ireland) as part of Microsoft 365, acting as our processor under Art. 28 GDPR; for any transfers to the USA Microsoft is certified under the EU-US Data Privacy Framework, supplemented by the EU Standard Contractual Clauses.

We pass your details on to third parties, such as the seller or developer of a property, only where this is necessary for the brokerage — for example for a reservation or to prepare the purchase contract.

Retention: we store enquiry data until your enquiry has been dealt with, for a maximum of 12 months from your last contact with us — every new enquiry through one of our forms starts that period afresh. The contact at Brevo is deleted by an automated daily process, or by our regular manual review, once the period has elapsed. This does not apply where a contractual relationship is established or where statutory retention and documentation obligations (e.g. under commercial and tax law or the German Anti-Money-Laundering Act) require longer storage.

When you request an exposé, we send the download link to the email address you provide; for security reasons the link is only valid for a limited time.

Waiting list for upcoming locations: if you register without obligation for a future location, we additionally process the location you selected and whether you are looking for a home to live in or for an investment. The latter reaches our office by email only and is not stored in your Brevo contact. We use a double opt-in procedure for this: after submitting the form you first receive a confirmation email; only once you click the link it contains do we add you to the waiting list and inform you about the project launch at that location. If you do not click the link, you are not added to the list. The legal basis for sending this information is your consent (Art. 6 (1)(a) GDPR). The consent applies until you withdraw it; you may withdraw it at any time via the unsubscribe link at the end of each of these emails or informally to office@carat.immo. The withdrawal does not affect the lawfulness of processing carried out before it.

Abuse prevention: to fend off automated bulk requests we derive a salted hash value from your IP address that cannot be traced back to you and use it to count requests within a one-hour window (rate limiting). The value is held solely in our server's memory and is discarded once the window has elapsed; it is not stored permanently and no usage profile is created from it. Legal basis: Art. 6 (1)(f) GDPR.

8. Google Maps (only with your consent)

On our contact page we offer a Google Maps map — it is only loaded after you click "Load map". Before that click, no connection of any kind is established to Google.

By clicking you consent (Art. 6 (1)(a) GDPR, § 25 (1) of the German TDDDG) to your browser connecting to Google servers, which transfers, among other things, your IP address to Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the parent company is Google LLC, USA. For transfers to the USA, Google relies on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. Processing after the map has loaded is Google’s responsibility; see Google’s privacy policy for details.

Your choice is stored exclusively locally in your browser (localStorage — no cookie is set and nothing is transmitted to us). You can withdraw your consent at any time directly at the map via "Hide map"; the withdrawal does not affect the lawfulness of processing carried out before it. Our office address is always available as plain text on the page.

9. 360° tour (only with your consent)

On individual project pages we offer a 360° tour served by zima.at (Austria) — it is only loaded after you click "Load 360° tour". Before that click, no connection of any kind is established to zima.at.

By clicking you consent (Art. 6 (1)(a) GDPR, § 25 (1) of the German TDDDG) to your browser connecting to the servers of zima.at, which transfers, among other things, your IP address and browser and device information. The recipient is the operator of zima.at (the controller named in the site notice at https://www.zima.at/impressum), Austria. Processing after the tour has loaded is the provider's responsibility.

Your choice is stored exclusively locally in your browser (localStorage — no cookie is set and nothing is transmitted to us). You can withdraw your consent at any time directly at the tour via "Hide tour"; the withdrawal does not affect the lawfulness of processing carried out before it. If you do not load the tour, no data are transferred.

10. Fonts, external content and shortlist

All fonts are self-hosted on our own servers (no requests to Google Fonts or other external services). Apart from the consent-gated map (section 8) and the 360° tour (section 9), this website does not embed any third-party content.

If you add properties to your shortlist, this selection is stored only locally in your browser (localStorage); it is not transmitted to us. Storing it is strictly necessary for the function you requested (§ 25 (2) no. 2 of the German TDDDG). You can remove entries yourself at any time or delete the site data in your browser.

11. Your rights

Under the GDPR you have, in particular, the following rights:

  • access to the personal data we process about you (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • objection to processing based on Art. 6 (1)(f) GDPR (Art. 21 GDPR),
  • withdrawal of consent with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6 (1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

An informal message to office@carat.immo is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

12. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

13. Changes to this privacy policy

We update this privacy policy whenever the website or the legal situation changes. The version published here applies.