Legal Notice / Privacy Policy

I. Provider Information pursuant to § 5 DDG

Service provider within the meaning of § 5 of the German Digital Services Act (Digitale-Dienste-Gesetz – DDG):

Oliver Ehlenz

Sole Proprietor

Zum Hahnacker 17

50129 Bergheim

Germany

Contact:

Phone: +49 151 10 70 9714

E-mail: olis.lifestyle@gmx.de

Website: www.olis.lifestyle

II. Supervisory Authority and Commercial License

The service provider holds a license pursuant to § 34c paragraph 1 of the German Trade Regulation Act (GewO), issued by:

Public Order Office

Department 32/1, General Safety and Public Order

Rhein-Erft-Kreis, District Administrator

Willy-Brandt-Platz 1

50126 Bergheim

Tel.: +49 2271 83-13224

Fax: +49 2271 83-23210

ordnungsamt@rhein-erft-kreis.de

http://www.rhein-erft-kreis.de

III. Professional Information

Professional title: Real Estate Agent with a license pursuant to § 34c of the German Trade Regulation Act (GewO) (granted in the Federal Republic of Germany)

IV. Responsible for Journalistic and Editorial Content (§ 18 para. 2 MStV)

Responsible within the meaning of § 18 paragraph 2 of the German State Media Treaty (Medienstaatsvertrag – MStV) for journalistic and editorial content is:

Oliver Ehlenz (Sole Proprietor)

Zum Hahnacker 17

50129 Bergheim

Germany

V. Consumer Dispute Resolution

Notice pursuant to § 36 of the German Consumer Dispute Resolution Act (VSBG): The service provider is neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

VI. Use of the Legal Notice on Social Media Platforms

This legal notice also applies to the service provider’s presences on the following platforms, provided that the service provider operates a profile or channel there:

• Instagram (@olis.life.invest) https://www.instagram.com/olis.life.invest?igsh=djM2dnR1ZnM4azQ0&utm_source=qr

• TikTok (Oliver Ehlenz Dubai Immobilien) (@olis-lifestyle) https://www.tiktok.com/@olis_lifestyle?is_from_webapp=1&sender_device=pc

• YouTube (Oliver Ehlenz | Dubai Immobilien) (@olis.lifestyle) http://www.youtube.com/@olis.lifestyle

• LinkedIn (Oliver Ehlenz) https://www.linkedin.com/in/oliver-ehlenz-a525aa84/

• XING (Oliver Ehlenz) https://www.xing.com/profile/Oliver_Ehlenz

• Facebook Business (OLI’S Lifestyle and Investment) https://www.facebook.com/share/14e3vua7mW7/?mibextid=wwXIfr

• Facebook (Oliver Ehlenz) https://www.facebook.com/share/1CTVtz715F/?mibextid=wwXIfr

VII. Copyright

The content published on this website – in particular texts, images, graphics, videos, and audio files – is protected by copyright law. Any use beyond the scope permitted by statutory provisions requires the prior written consent of the respective rights holder.

OPTIONAL: Reservation of Use for Text and Data Mining Purposes (§ 44b para. 3 German Copyright Act – UrhG):

The service provider expressly reserves the right, with regard to all content published on this website as well as on the associated social media profiles, to prohibit the use of such content for text and data mining purposes within the meaning of § 44b paragraphs 1 and 2 of the German Copyright Act (UrhG). This applies in particular to the use of the content for the training, validation, or operation of artificial intelligence systems or generative AI models. Reproduction of the content for such purposes is not permitted without the prior express consent of the service provider.

This reservation of rights shall be understood as a machine-readable declaration within the meaning of § 44b paragraph 3 sentence 2 UrhG and will – where technically possible – also be provided in machine-readable form (e.g. via robots.txt, meta tags, or TDMRep standards).

§ 1 Controller and Data Protection Officer

The controller within the meaning of Article 4 No. 7 of the General Data Protection Regulation (DSGVO) and other national data protection laws as well as other data protection regulations is:

OLI'S LIFESTYLE AND INVESTMENT

Owner: Oliver Ehlenz (Sole Proprietor)

Zum Hahnacker 17

50129 Bergheim

Germany

Phone: +49 151 10 70 9714

E-mail: olis.lifestyle@gmx.de

Website: www.olis.lifestyle

No data protection officer has been appointed, as the legal requirements for a mandatory appointment pursuant to Article 37 DSGVO and § 38 of the German Federal Data Protection Act (BDSG) are not met.

§ 2 General Information on Data Processing

1. Scope of the Processing of Personal Data

Personal data of users is generally processed only to the extent necessary to provide a functional website as well as the content and services of the controller. The processing of personal data is regularly carried out only with the consent of the data subject or where the processing is permitted by statutory provisions.

The respective legal basis for the individual processing activities is specified in the overview in § 3 as well as in the respective detailed provisions in §s 4 et seq. of this Privacy Policy.

2. Deletion of Data and Storage Period

Personal data shall be deleted or blocked as soon as the purpose of storage no longer applies. Further storage may take place if this has been provided for by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject (in particular commercial and tax retention obligations pursuant to §s 257 German Commercial Code (HGB) and 147 German Fiscal Code (AO), generally requiring retention periods of six or ten years). Data shall also be blocked or deleted when a storage period prescribed by the aforementioned provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

3. Recipients of Personal Data

External service providers are partly used for the provision of the website and the performance of services. Personal data may therefore – where necessary – be transferred to the following categories of recipients:

• Hosting and IT service providers

• Providers of e-mail and communication services

• Providers of consent management solutions

• Providers of analytics and marketing services (where used and based on consent)

• Operators of social networks and messenger services (within the scope of communication with the controller through such services)

• External partner companies, consultants, or service providers to whom contact data may be forwarded in the context of a specific inquiry (see § 6 No. 7)

Where external service providers process personal data on behalf of the controller, this is carried out on the basis of data processing agreements pursuant to Article 28 DSGVO.

4. Provision of Personal Data – Legally or Contractually Required?

a. For the mere visit of the website, the provision of personal data beyond the connection data technically unavoidable for accessing a website is not required. If website functions (e.g. cookie-related convenience functions or embedded third-party content) are not activated, this may result in such functions not being available or not being fully usable.

b. If you contact the controller via the contact form, by e-mail, telephone, messenger services, or other communication channels and submit an inquiry aimed at initiating or concluding a contract, the provision of the data required for this purpose – in particular name, contact details, and the content of the inquiry – is necessary for processing the inquiry and for the initiation of a contract. You are not obliged to provide this data; however, without it, the inquiry cannot be processed and a contract cannot be initiated or concluded.

c. Within the scope of real estate brokerage activities and other activities subject to the commercial license pursuant to § 34c GewO, the controller may be subject to statutory identification obligations pursuant to §s 10 and 11 of the German Money Laundering Act (GwG). The provision of the data required for this purpose – in particular data relating to the contracting party and, where applicable, a beneficial owner, as well as the submission of suitable identification documents – may therefore be legally required (Article 6 para. 1 lit. c DSGVO in conjunction with §s 10 and 11 GwG). If such data is not provided or not provided in full, the controller is legally prohibited from establishing or continuing the business relationship or carrying out the transaction. Data already collected is subject to the statutory recording and retention obligations under the GwG regardless of whether a contract is concluded (retention period generally five years); furthermore, there may be an obligation to submit a suspicious activity report to the Financial Intelligence Unit (FIU).

d. Within the scope of arranging contacts with external partner companies or service providers (see § 6 No. 7) – for example in connection with visa or residency procedures, company formations, account openings, or similar services – additional personal data or documents may be required depending on the type of requested service. These may partly be required by the partner company or by competent authorities of the respective third country. You are not legally obliged to provide such data; however, without such provision, the subsequent service by the partner company may not be performed or may not be fully performed.

5. No Further Obligation to Provide Personal Data / Automated Decision-Making Including Profiling

There is no further contractual or legal obligation to provide personal data.

Automated decision-making in individual cases, including profiling within the meaning of Article 22 DSGVO, does not take place.

§ 3 Overview of Processing Activities

The following table provides an overview of the main processing activities on the website, the respective categories of processed data, the purposes of processing, the relevant legal bases, and the storage periods.

Detailed information – including legitimate interests, recipients, and third-country transfers – can be found in the detailed provisions in §s 4 et seq. below. In the event of discrepancies between the table and the detailed provisions, the detailed provisions shall prevail.

§ 4 Provision of the Website and Creation of Server Log Files

1. Description and Scope of Data Processing

Each time the website is accessed, the system automatically collects data and information from the computer system of the accessing device. The following data is collected:

• IP address of the accessing device

• Date and time of access

• Accessed URL

• Name of the browser and operating system used

• Referrer URL (previously visited page, if transmitted)

• Amount of data transferred and delivery status message

2. Legal Basis

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f DSGVO.

3. Purpose and Legitimate Interest

The temporary storage of the IP address is necessary in order to deliver the website to the user’s device. Storage in log files takes place to ensure the functionality of the website, to optimize the website offering, and to ensure the security of the information technology systems.

These purposes constitute the controller’s legitimate interest in data processing. The data is not evaluated for marketing purposes in this context.

4. Storage Period

The data shall be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

In the case of storage in log files, this shall occur no later than seven days thereafter. Further storage is possible if the IP addresses of users are deleted or anonymized in such a way that it is no longer possible to identify the accessing client.

5. Right to Object and Removal Option

The collection of data for the provision of the website and the storage of data in log files are absolutely necessary for the operation of the website. Consequently, the user has no option to object.

§ 5 Cookies and Consent Management

1. General Information

Cookies and comparable technologies (e.g. local storage) are used on the website. Cookies are small text files stored on the user’s device which may provide information to the controller or integrated third parties.

A distinction is made between two categories of cookies:

• Technically necessary cookies, which are absolutely required for the operation of the website (e.g. storage of language settings, ensuring session functionality, storage of cookie consent).

• Non-essential cookies and comparable technologies, in particular for analytics, marketing, and convenience purposes, as well as for the integration of third-party content.

2. Legal Bases

For technically necessary cookies and storage processes, the processing is based on § 25 para. 2 no. 2 TDDDG as well as on the controller’s legitimate interest in the secure and functional operation of the website (Art. 6 para. 1 lit. f DSGVO).

For non-essential cookies and comparable technologies, storage is based on § 25 para. 1 TDDDG as well as on prior consent pursuant to Art. 6 para. 1 lit. a DSGVO. Consent may be withdrawn at any time with effect for the future.

3. Consent Management with Cookiebot

The consent management tool “Cookiebot” provided by Cybot A/S (now part of the Usercentrics Group), Havnegade 39, 1058 Copenhagen K, Denmark, is used to obtain, manage, and document user consents.

When the website is accessed for the first time, a consent banner is displayed in which users may grant, reject, or individually manage their consent to the use of non-essential cookies and third-party services. The consent decision is stored in a cookie on the user’s device so that the banner does not need to be displayed again each time the website is accessed.

Within the scope of consent management, the following data in particular is processed:

• anonymized IP address

• date and time of consent

• browser and device information

• URL of the visited page

• type and scope of the granted or denied consent

The legal basis for the processing of consent data is Art. 6 para. 1 lit. c DSGVO (fulfillment of the documentation and verification obligations pursuant to Art. 7 para. 1 DSGVO) as well as Art. 6 para. 1 lit. f DSGVO (legitimate interest in legally compliant consent management).

Further information regarding data processing by Cookiebot can be found at: https://www.cookiebot.com/de/privacy-policy/

4. Viewing of Cookies Used and Withdrawal of Consent

An up-to-date overview of the cookies and similar technologies used on the website, including their providers, storage periods, and purposes, can be accessed at any time via the cookie banner or the cookie settings. Through these settings, consent once granted may be withdrawn at any time with effect for the future.

Cookies may also be deleted via the settings of the browser used, or the storage of cookies may be restricted or prevented. In such cases, not all functions of the website may be fully usable.

§ 6 Contact Requests, Inquiries, and Referral of Contacts

1. Contact Form

A contact form is provided on the website based on the WordPress plugin “Contact Form 7” (Rock Lobster, LLC). The data entered via the form is stored on the web server used by the controller and transmitted by e-mail to the address specified in the legal notice.

No transfer to third parties takes place within the scope of the form processing itself; forwarding to external partner companies may only take place in accordance with the provisions of No. 7.

Within the scope of contacting the controller via the contact form, the following data is processed:

• first and last name

• e-mail address

• telephone number (if provided)

• place of residence or address (if provided)

• content of the inquiry

• technical data (IP address, date and time of transmission) to ensure functionality and protection against misuse

2. Contact by E-Mail, Telephone, or Video Conference

Where contact is made via e-mail, telephone, video conference, or comparable means of communication, the personal data transmitted within the scope of the communication shall be processed exclusively for the purpose of handling the respective inquiry and the related communication.

3. Contact via Messenger Services

Contact may also be made via messenger services (in particular WhatsApp, WhatsApp Business, and, where applicable, others). When using such services, telephone numbers, profile information, message contents, and, where applicable, transmitted files are processed.

Please note that the respective providers process the transmitted data under their own responsibility and may also transfer such data to third countries (in particular the United States). Encryption is carried out in accordance with the respective provider’s technical specifications; however, a level of protection comparable to an end-to-end encrypted e-mail or a protected upload portal cannot be guaranteed.

It is therefore recommended not to transmit particularly sensitive or confidential documents via messenger services.

4. Contact via Social Networks

Contact may also be made via the social media profiles specified in § 8 of this Privacy Policy (Instagram, TikTok, YouTube, and, where applicable, others). In the event of contact through comments, direct messages, or comparable functions, the respective platform operator additionally processes personal data under its own responsibility. The controller has no influence over such processing.

It is recommended not to transmit particularly sensitive inquiries or documents via social media platforms.

5. Transmitted Documents and Confidential Records

Within the scope of an inquiry, users may voluntarily transmit documents to the controller, for example copies of identification documents, banking, tax, or corporate records. Such documents are processed exclusively for the purpose of handling the respective inquiry and are stored only to the extent necessary for this purpose or required by statutory retention obligations. Any forwarding to external partner companies or service providers shall only take place in accordance with the provisions of No. 7.

Where special categories of personal data within the meaning of Art. 9 para. 1 DSGVO are transmitted (for example health data contained in medical documents), such data shall be processed exclusively on the basis of explicit consent pursuant to Art. 9 para. 2 lit. a DSGVO.

Where the controller, within the scope of brokerage activities, is subject to anti-money laundering identification obligations pursuant to § 2 para. 1 no. 14 GwG, the collection and retention of the required identification and documentation records is not voluntary but legally required (Art. 6 para. 1 lit. c DSGVO in conjunction with §s 10, 11, 8 GwG).

6. Legal Bases, Purpose, and Storage Period

Depending on the specific circumstances, the legal basis for processing in the context of contact requests is:

• Art. 6 para. 1 lit. f DSGVO (legitimate interest in handling inquiries and communicating with interested parties), where the inquiry is a purely informational request without relation to a specific contract;

• Art. 6 para. 1 lit. b DSGVO (pre-contractual measures or contract performance), where the inquiry relates to the initiation or conclusion of a paid service agreement with the controller regarding administrative or organizational support services;

• Art. 6 para. 1 lit. a DSGVO (consent), in particular for the transfer of contact data to external partner companies (see No. 7) and for the transmission of special categories of personal data (Art. 9 para. 2 lit. a DSGVO);

• Art. 6 para. 1 lit. c DSGVO in conjunction with §s 10, 11, 8 GwG, where the controller is subject to statutory identification and record-keeping obligations within the scope of brokerage activities.

The purpose of processing is the handling of the respective inquiry and the related communication.

The storage period is determined according to the following criteria:

• Inquiries that do not lead to a contract or brokerage service: communication data is generally deleted within three months after final processing of the inquiry, provided there are no concrete indications that communication will resume.

• Inquiries leading to a service agreement or brokerage service: communication data is processed until termination of the business relationship and subsequently retained in accordance with statutory retention obligations (§s 257 HGB, 147 AO – generally six or ten years).

• Data and documents forwarded to external partner companies are generally retained by the controller for up to six months after completion of the brokerage activity, insofar as this is necessary for evidentiary purposes and no longer statutory retention obligation exists.

• Data collected within the scope of anti-money laundering obligations is retained pursuant to § 8 para. 4 GwG for five years after the end of the business relationship or transaction; deletion shall take place no later than after ten years.

7. Transfer of Contact Data to External Partner Companies

Within the scope of activities as an information and referral office, it may be necessary for contact data and, where applicable, information transmitted with the inquiry to be forwarded to external partner companies or service providers – such as real estate consultants, relocation service providers, company formation agencies, banks, lawyers, or tax advisors – in order to initiate a specific service relationship between the user and the partner company.

Such transfer shall take place exclusively:

• on the basis of the user’s explicit consent (Art. 6 para. 1 lit. a DSGVO), or

• insofar as this is necessary for carrying out pre-contractual measures or for contract performance within the meaning of Art. 6 para. 1 lit. b DSGVO with the user.

The transmitted data typically includes first and last name, e-mail address, telephone number, place of residence, and the content of the inquiry. Where transmission of additional documents is required in individual cases, this shall take place only on a separate legal basis.

After transfer of the data, the partner company processes the data under its own responsibility; the partner company’s privacy policy shall then apply.

§ 7 Integrated Third-Party Services and Content

The website integrates content and functions provided by third-party providers. Unless such third-party services are technically indispensable for the operation of the website, they are only loaded after consent has been granted via the consent management tool.

When such content is accessed, personal data (in particular IP address, technical browser and device information, and where applicable the URL of the accessed page) may be transmitted to the servers of the respective providers. Where providers operate servers in third countries (in particular the United States), the additional information in § 9 shall apply.

1. YouTube Videos (Google Ireland Limited)

Videos from the YouTube platform are embedded on the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Integration takes place either in enhanced privacy mode (“youtube-nocookie.com”) or via an upstream click solution, so that a connection to Google’s servers is generally established only when the user actively starts the video.

When a video is activated, Google may in particular process the IP address, browser and device information, and information regarding the accessed page. If the user is logged into a Google account, Google may associate the access with the user account.

The legal basis is the user’s consent pursuant to Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TDDDG. Data may be transferred to third countries; in this respect, § 9 of this Privacy Policy shall apply.

Further information regarding data processing by Google: https://policies.google.com/privacy

2. Google Fonts

Where fonts from Google Fonts are dynamically integrated, a connection to Google servers (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is established when the website is accessed. Google may in particular process the user’s IP address.

Dynamic integration takes place exclusively after prior consent pursuant to Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TDDDG. If consent is not granted, fonts are delivered locally from the controller’s server or as standard fonts.

Further information: https://policies.google.com/privacy

3. WonderPush (Push Notifications)

The website uses the “WonderPush” service of WonderPush SAS, 23 rue d’Anjou, 75008 Paris, France, in order to send web push notifications to users after explicit consent has been granted.

When the website is loaded, the WonderPush SDK is integrated, which stores information in the browser’s local storage (e.g. an anonymous device identifier and the notification consent status) and communicates with WonderPush servers.

Within the scope of the service, the following data in particular may be processed:

• anonymous device identifier (push token)

• browser and device information

• notification consent status

• interactions with sent notifications

The legal basis is the user’s consent pursuant to Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TDDDG both for the storage of information on the device and for the subsequent sending of push notifications.

Consent may be withdrawn at any time, in particular by disabling notifications in the browser settings.

Further information regarding data processing by WonderPush: https://www.wonderpush.com/legal/privacy

4. Google Analytics 4

The website uses the web analytics service “Google Analytics 4” (hereinafter “Google Analytics”) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics uses cookies and comparable technologies to analyze the use of the website. In particular, the following information is processed: anonymized IP address, technical browser and device information, referrer URL, pages visited, duration of visit, click and interaction data, and a pseudonymous user identifier.

The IP address is shortened using Google’s IP anonymization function before further processing.

The legal basis is the user’s consent pursuant to Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TDDDG. Consent is obtained via the consent management tool; without consent, Google Analytics is not loaded.

Google also processes data in the United States. Where transmitted data is transferred to Google LLC based in the United States, the transfer is based on the adequacy decision of the European Commission of 10 July 2023 regarding the EU-US Data Privacy Framework, under which Google is certified.

Storage period: User and event data are automatically deleted after 14 months.

Further information regarding data processing by Google: https://policies.google.com/privacy

5. Google Tag Manager

The website uses “Google Tag Manager” provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a technical tool for managing and delivering website tags (third-party scripts such as analytics or marketing tools). Google Tag Manager itself does not create user profiles or store cookies.

However, when the Tag Manager is loaded, the IP address and technical connection data are transmitted to Google servers; this is technically necessary in order for the Tag Manager to function.

The tags delivered via the Tag Manager (in particular Google Analytics, Meta Pixel, TikTok Pixel) are each described separately in this Privacy Policy; the respective applicable legal basis derives from the specific integrated tool.

The legal basis for the use of the Tag Manager itself is the user’s consent pursuant to Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TDDDG.

With regard to data transfers to the United States, the adequacy decision mentioned under No. 4 applies.

Further information: https://policies.google.com/privacy

6. Google Maps

The website integrates map content from “Google Maps” as an embedded map (iframe). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When accessing a page containing an embedded Google Maps map, the IP address, technical browser and device information, and the accessed URL are in particular transmitted to Google servers. If the user is logged into a Google account, Google may associate the access with the user account.

A connection to Google’s servers is established only after the user has granted consent. Consent is obtained via the consent management tool used on the website.

In addition, an upstream click solution may be used so that the map is loaded only after an active click on a corresponding placeholder. Before consent has been granted or before active confirmation, a placeholder view with notice and consent option is displayed instead of the map.

The legal basis is Art. 6 para. 1 lit. a DSGVO in conjunction with § 25 para. 1 TDDDG.

With regard to data transfers to the United States, the adequacy decision mentioned under No. 4 applies.

Further information: https://policies.google.com/privacy

7. Meta Pixel (Facebook/Instagram)

The website uses the “Meta Pixel” (also “Facebook Pixel”) provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

The Meta Pixel is a JavaScript code that evaluates visitor behavior on the website and enables measurement of the effectiveness of advertisements on Facebook and Instagram as well as the display of target-group-specific advertising (“Custom Audiences”, “Lookalike Audiences”).

In particular, the following information is transmitted to Meta: IP address, technical browser and device information, pages visited, triggered actions (e.g. clicks, inquiries), and a pseudonymous user identifier.

Through so-called “Advanced Matching”, hashed contact information (e.g. e-mail address, telephone number) may additionally be transmitted where the user enters such data into a form.

For the collection and transmission of data to Meta, joint controllership exists between the controller and Meta within the meaning of Art. 26 DSGVO.

The underlying agreement on joint controllership is available at: https://www.facebook.com/legal/controller_addendum

Processing of the data by Meta after transmission takes place under Meta’s sole responsibility.

The legal basis is the user’s consent pursuant to Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TDDDG. Consent is obtained via the consent management tool; without consent, the Meta Pixel is not loaded.

Meta also processes data in the United States. The transfer is based on the adequacy decision of the European Commission regarding the EU-US Data Privacy Framework of 10 July 2023, under which Meta is certified.

Further information regarding data processing by Meta: https://www.facebook.com/privacy/policy

8. TikTok Pixel

The website uses the “TikTok Pixel” provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok”).

The TikTok Pixel is a JavaScript code for analyzing user behavior and displaying target-group-specific advertising on TikTok.

In particular, the following information is transmitted to TikTok: IP address, technical browser and device information, pages visited, triggered actions, and a pseudonymous user identifier.

The legal basis is the user’s consent pursuant to Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TDDDG. Consent is obtained via the consent management tool; without consent, the TikTok Pixel is not loaded.

TikTok may also transfer data to its parent company ByteDance Ltd., based in the United States and the People’s Republic of China. No adequacy decision of the European Commission exists for the People’s Republic of China; therefore, the transfer is based on standard contractual clauses pursuant to Art. 46 para. 2 lit. c DSGVO as well as additional technical and organizational measures described by TikTok in its Privacy Policy.

For any transfer to the United States, the adequacy decision mentioned under No. 4 applies insofar as the respective recipient is certified under the EU-US Data Privacy Framework.

Please note that data processing by TikTok is controversial from a data protection perspective due to the corporate structure and potential access rights of Chinese authorities; therefore, such transfers involve increased risks.

Further information: https://www.tiktok.com/legal/privacy-policy-eea

9. Joint Controllership pursuant to Art. 26 DSGVO

Where the Meta Pixel is used on the website, joint controllership exists for the collection and transmission of data to Meta within the meaning of Art. 26 DSGVO.

The underlying agreement is available at the link specified under No. 7.

The essential content of the agreement may be summarized as follows: Meta undertakes to fulfill the data protection information obligations (Arts. 13 and 14 DSGVO) towards data subjects and to safeguard the rights of data subjects pursuant to Arts. 15 to 22 DSGVO; the controller shall cooperate to the extent necessary.

Data subjects may assert their rights both against the controller and directly against Meta.

§ 8 Social Media Presences (Instagram, TikTok, YouTube)

The controller maintains profiles and/or channels on the following social networks:

• Instagram, operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland

• TikTok, operated in Europe by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

• YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

• LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (LinkedIn)

• XING, operated by New Work SE, Baumwall 7, 20459 Hamburg, Germany (new-work.se)

When visiting these profiles or channels, personal data (in particular IP address, device and browser information, profile data, and interaction data) is processed by the respective platform operator. The controller has no direct influence over such processing.

Processing of data by the platform operators takes place on the basis of their own privacy policies and terms of use.

Where the controller is jointly responsible with the respective platform operator for processing activities within the meaning of Art. 26 DSGVO – in particular with regard to statistical evaluations concerning user behavior and reach (“Insights”) – corresponding agreements on joint controllership exist, insofar as the respective provider provides such agreements.

Requests regarding data processing may be addressed both to the controller and directly to the respective platform operator; the essential obligations to inform data subjects are generally fulfilled by the platform operator.

The legal basis for the controller’s own processing activities in connection with the social media presences is Art. 6 para. 1 lit. f DSGVO; the legitimate interest consists in the public presentation of the company, informing interested parties, and communicating with users.

Where contact is actively initiated by the user via the platform, Art. 6 para. 1 lit. b DSGVO additionally applies.

Privacy policies of the platform operators:

• Instagram / Meta: https://www.facebook.com/privacy/policy

• TikTok: https://www.tiktok.com/legal/privacy-policy-eea

• YouTube / Google: https://policies.google.com/privacy

• LinkedIn: https://www.linkedin.com/legal/privacy-policy

• XING: https://privacy.xing.com/de/datenschutzerklaerung

§ 9 Transfers of Data to Third Countries

Within the scope of the processing activities described in this Privacy Policy, personal data may be transferred to countries outside the European Union and the European Economic Area.

This concerns in particular providers of third-party services with headquarters or servers in the United States (e.g. Google, Meta, and, where applicable, WonderPush when using US-based sub-services) as well as potential transfers of data to partner companies in the United Arab Emirates (UAE) within the scope of the referral activities described in § 6 No. 7.

1. Transfers to the United States

Where providers have parent companies in the United States or use sub-processors in the United States and are certified under the EU-US Data Privacy Framework, the transfer is based on an adequacy decision of the European Commission pursuant to Art. 45 DSGVO dated 10 July 2023 (Implementing Decision (EU) 2023/1795).

If the respective recipient is not certified, the transfer shall take place on the basis of standard contractual clauses pursuant to Art. 46 para. 2 lit. c DSGVO or on the basis of explicit consent pursuant to Art. 49 para. 1 lit. a DSGVO.

A list of companies certified under the EU-US Data Privacy Framework is available at: https://www.dataprivacyframework.gov/list

2. Transfers to the United Arab Emirates

At present, no adequacy decision pursuant to Art. 45 DSGVO exists for the United Arab Emirates.

Where data or documents are transferred to recipients in the UAE within the scope of a specific inquiry, a distinction is made between the following categories of recipients:

a) Private partner companies and service providers (in particular real estate companies, relocation service providers, company formation agencies):

Where legally and factually possible, transfers to such recipients are safeguarded on the basis of the standard contractual clauses adopted by the European Commission pursuant to Art. 46 para. 2 lit. c DSGVO (Implementing Decision (EU) 2021/914).

A copy of the standard contractual clauses and, where applicable, additional technical and organizational measures may be requested via the contact address stated in the legal notice.

b) Authorities, public bodies, and comparable sovereign recipients (in particular authorities such as GDRFA, Dubai Land Department, MOFA, economic and licensing authorities, notaries, lawyers, tax advisors, free zone authorities):

It is not possible to conclude standard contractual clauses with such recipients.

Where transfers to such entities are necessary, they are based on Art. 49 para. 1 lit. b DSGVO (necessity for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken at the request of the data subject) or – where the transfer serves the establishment, exercise, or defense of legal claims of the data subject – on Art. 49 para. 1 lit. e DSGVO.

Additionally, transfers may take place on the basis of the explicit consent of the data subject after prior information regarding the possible risks (Art. 49 para. 1 lit. a DSGVO).

c) Banks and comparable financial service providers:

Where bank onboarding or account opening in the UAE is intended, data collection and processing within the further procedure generally takes place directly between the data subject and the respective bank.

In such cases, any transfer by the controller is limited to the data required for initiating contact and is based, depending on the circumstances, on the legal bases specified under letters a or b.

The data subject shall be informed separately prior to any transfer about the risks associated with transfers to the United Arab Emirates – in particular that the level of data protection in the UAE does not correspond to the level of the European Union and that data subject rights vis-à-vis recipients in the UAE may not be enforceable or may only be enforceable to a limited extent.

Transfers shall take place exclusively insofar as they are necessary for handling the specific inquiry and for the requested referral or support service.

§ 10 Rights of the Data Subject

Where personal data is processed, the data subjects are data subjects within the meaning of the DSGVO. They are entitled to the following rights vis-à-vis the controller:

1. Right of Access (Art. 15 DSGVO)

You may request confirmation from the controller as to whether personal data concerning you is being processed.

Where such processing exists, you may request access to such data and to the information listed in detail in Art. 15 para. 1 DSGVO, in particular regarding processing purposes, categories of processed data, recipients, planned storage period, the existence of rights to rectification, erasure, restriction of processing and objection, the existence of a right to lodge a complaint, the origin of the data, and any automated decision-making.

You also have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organization and to be informed about the appropriate safeguards pursuant to Art. 46 DSGVO.

2. Right to Rectification (Art. 16 DSGVO)

You have the right to obtain from the controller the rectification and/or completion of inaccurate or incomplete personal data concerning you.

3. Right to Restriction of Processing (Art. 18 DSGVO)

You have the right, under the conditions set out in Art. 18 DSGVO, to request restriction of the processing of personal data concerning you.

4. Right to Erasure (Art. 17 DSGVO)

You may request from the controller that personal data concerning you be erased without undue delay where one of the grounds specified in Art. 17 para. 1 DSGVO applies.

The right to erasure does not exist insofar as processing is necessary for one of the reasons stated in Art. 17 para. 3 DSGVO (in particular for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims).

5. Right to Notification (Art. 19 DSGVO)

Where you have exercised the right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to communicate such rectification, erasure, or restriction to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort.

Upon request, you shall be informed about those recipients.

6. Right to Data Portability (Art. 20 DSGVO)

Where processing is based on consent pursuant to Art. 6 para. 1 lit. a DSGVO or on a contract pursuant to Art. 6 para. 1 lit. b DSGVO and carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format and the right to transmit such data to another controller without hindrance from the controller.

7. Right to Object (Art. 21 DSGVO)

You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f DSGVO; this also applies to profiling based on those provisions.

The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms or where the processing serves the establishment, exercise, or defense of legal claims.

Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.

8. Right to Withdraw Consent (Art. 7 para. 3 DSGVO)

You have the right to withdraw any data protection consent granted at any time with effect for the future.

Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Withdrawal may be made informally by e-mail to the address specified in the legal notice or via the cookie settings (for cookie-related consents).

9. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 DSGVO)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the DSGVO.

The following supervisory authority is locally competent for the controller:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, https://www.ldi.nrw.de.

§ 11 Current Validity and Amendments to this Privacy Policy

This Privacy Policy is currently valid and has the status as of 05/2026.

Due to the further development of the website and services or due to changed statutory or regulatory requirements, it may become necessary to amend this Privacy Policy.

The current version of the Privacy Policy may be accessed and printed at any time on the website.