Privacy Policy

This English version is provided for convenience only. In the event of any discrepancy between the German and the English version, the German version shall prevail: Datenschutzerklärung.

Last updated: 27 October 2026

With this policy we inform you, pursuant to Articles 13 and 14 of the General Data Protection Regulation
(Datenschutz-Grundverordnung, GDPR), which personal data we process when you use diskret.immo or when we keep your
search profile from our client base on diskret.immo: for what purposes, on what legal basis, to whom we disclose data
and how long we store it.

Contents

1. Controller
2. Key points at a glance
3. Provision of the website and server log files
4. Cookies and storage in the browser
5. Protection against misuse
6. Search in your own words, anonymous profile assistant and provisionally saved search
7. Map view (OpenStreetMap)
8. Forms: callback, offer a property confidentially, become a partner agent
9. Account for buyers, owners and estate agents
10. Creating a buyer profile (with or without a document)
11. Search profiles, matching with anonymous profiles and quiet market test
12. Search profiles from the client base of IMMOBRA GmbH
13. Exposé requests, confidentiality and release stages
14. Anonymous profiles, owner information and data of third parties (in particular tenants)
15. Access log
16. Email communication
17. Recipients
18. Transfers to third countries
19. Retention periods at a glance
20. Obligation to provide data, no automated decision-making
21. Your rights
22. Artificial intelligence
23. Changes to this policy

---

1. Controller

diskret.immo is a platform of

IMMOBRA GmbH
Alte Krakauer Str. 29
14776 Brandenburg an der Havel
Represented by the managing director (Geschäftsführer) René Lindelaub
Telephone: 0800-1887060 (free of charge from within Germany)
Email: info@diskret.immo

For all questions about data protection and for exercising your rights, you can reach us using the contact details
above, most easily by email to info@diskret.immo.

2. Key points at a glance

• We use no analytics, advertising or tracking services and load no fonts or scripts from third-party
  servers. We use cookies only to the extent that they are technically necessary for logging in. This is why we do
  not show a cookie banner.
• The only exception to „our own server only“ is the detail map: the map tiles come from OpenStreetMap
  (section 7).
• Anonymous profiles (Steckbriefe) are anonymous. From the quiet market test (stiller Test), owners learn only
  how many search profiles match, and only from three onwards, never names.
• Anyone who requests an exposé discloses their name and company to the owner or to the agent handling the
  property (section 13).
• We pass on your details from the selling form to partner agents only with your separate consent.
• An external AI service is currently not switched on (section 22).

3. Provision of the website and server log files

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf,
in data centres in Germany. ALL-INKL.COM processes the data on our behalf on the basis of a data processing agreement
(Art. 28 GDPR).

Each time a page is accessed, the server processes technically necessary information: IP address, date and time,
requested address, amount of data transferred, status code, the previously visited page (referrer), browser type and
operating system. The purpose is to deliver the pages, to ensure stable operation and to detect and defend against
attacks. The legal basis is our legitimate interest in a secure and functioning service
(Art. 6(1)(f) GDPR). The log files are deleted after seven days. They are not combined with other data.

The connection to diskret.immo is encrypted using TLS (recognisable by „https://“ in the address bar).

4. Cookies and storage in the browser

We use only cookies that are strictly necessary so that you can use the service you have expressly requested
(§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act
(Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG)). As long as you do not log in, diskret.immo sets no
cookies.

The processing associated with logging in is based on Art. 6(1)(b) GDPR (use of your account).
We load fonts, scripts and graphics exclusively from our own server.

5. Protection against misuse

To protect against automated requests, we do not use external services such as reCAPTCHA. Our forms contain a field
that is invisible to humans and a time check. We also limit the number of requests per connection: for this purpose we
derive a check value (hash) from your IP address and store only this value, together with a counter, for a maximum of
one hour. Notifications such as „Your message has been received“ are stored for visitors without an account under such
a check value for two minutes. The legal basis is our legitimate interest in defending against spam and attacks
(Art. 6(1)(f) GDPR).

6. Search in your own words, anonymous profile assistant and provisionally saved search

Search: Your entry in the search field is translated on our server, according to fixed rules, into search criteria
(for example location, property type, price range, floor area, yield) and matched against the anonymous profiles. No
account is required for this. We do not store the search text unless you save the search as a search profile. Please
do not enter any names, addresses or telephone numbers in the search field.

Anonymous profile assistant for owners: If you describe your property in one sentence, our server generates an
anonymous preview and an assessment of demand from it. Nothing is stored in the process; we receive data only when you
submit the form „Offer a property confidentially“ (Immobilie vertraulich anbieten) (section 8).

Exposé check: If you upload an exposé (PDF, DOCX or TXT, max. 10 MB), our server reads the text once and takes from
it only key data (property type, location or postcode, price, floor areas, units, year of construction, rent or yield).
We use this key data to count the matching search profiles; a figure is shown only from three matches onwards. The file
remains on our server only for the duration of the analysis; the file and the extracted text are deleted immediately
afterwards and are not stored permanently. We do not evaluate names, street details or contact details contained in the
exposé, and we do not pass anything on to third parties. No AI service is used for this. No account is required; to
prevent misuse, we limit the number of requests as described in section 5.

Exposés sometimes contain information about other persons, such as owners or tenants. We process such information only
transiently as part of the reading process described above, without evaluating or storing it. Please only upload
exposés that you are entitled to pass on, and remove or redact details about tenants and any other personal data not
needed for the check.

Match check: In the match check you answer five questions (property type, location as postcode or town, size band,
price range, timeframe), without name, address or account. Our server compares property type, location, size and price
with the active search profiles (sections 11 and 12) and shows the result only as a range and only from three matching
profiles; the share of profiles with a verified account is also shown only from three. Your answers are not stored and
are discarded after the response; to prevent misuse we limit the number of queries as described in section 5. No AI
service is used, no cookies are set, nothing is passed on to third parties.

Anonymous demand statistics: From search mandates, purchase requests and buyer profiles we compile anonymous
statistics (e.g. number of search profiles per location and property type, median budget), which we publish on
diskret.immo. No names or contact details are used; groups of fewer than three profiles are not shown, and a median
budget only from five profiles that state a price. In the same way, search profiles flow anonymously into the count of
the match check, distinguished only as “matching” and “with a verified account”. The legal basis is Art. 6(1)(f) GDPR
(legitimate interest in an anonymous market overview).

Provisionally saved search: If you would like to save a search before you have an account, we provisionally keep
the criteria and search text for a maximum of 24 hours under a random key and create the search profile as soon as you
register. The provisional entry is then deleted.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the search, preview and exposé check
functions you use without requiring an account; for the exposé check and the match check, also in giving you and us an assessment of demand.
Any information about third parties contained in an exposé is processed only briefly and without evaluation, so that
their interests do not override ours. You may object to this processing at any time (section 21). As soon as you create
an account, Art. 6(1)(b) GDPR applies.

7. Map view (OpenStreetMap)

The golden map of Germany in the page header and the buyer map on the selling page are graphics from our own server;
no data is transmitted to third parties in this context. The buyer map shows only aggregated figures per region, and
only from three search profiles onwards.

In the list of off-market properties we additionally show a detail map. The map software (Leaflet) is located on
our server; however, your browser loads the map tiles directly from the servers of the OpenStreetMap Foundation
(OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. This happens automatically as
soon as the map comes into the visible area of the page. In the process, the OSMF receives your IP address, the map
sections requested, the address of the calling page and information about your browser and operating system. According
to our review, the tile service does not set any cookies. The OSMF processes this data under its own responsibility;
details can be found in its privacy policy at https://osmfoundation.org/wiki/Privacy_Policy. The OSMF delivers the
tiles via a content delivery service provider; we therefore cannot rule out processing outside the EU and the United
Kingdom.

On the map, circles mark only the town or locality, never the location or address of a property.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in showing prospective buyers the regional
distribution of the offers clearly and without an additional click. You may object to this processing at any time
(section 21). If you wish to avoid the transmission, you can block content from tile.openstreetmap.org in your
browser; the list of anonymous profiles also works without the detail map.

8. Forms: callback, offer a property confidentially, become a partner agent

Callback and contact: name, email address, telephone number, matter, preferred callback time, message.

Offer a property confidentially (two steps): property type, town or region (without street), price expectation,
floor area, number of units, time frame, short description; in addition name, email address, telephone number
(optional) and your role (owner, authorised representative or community of heirs, estate agent).

Become a partner agent: name, email address, telephone number (optional), company, area of activity, your
confirmation that a licence pursuant to § 34c of the German Trade Regulation Act (Gewerbeordnung, GewO) has been
granted, message.

We also store the page from which you sent the form. Your details are stored as an „incoming entry“ (Eingang) in our
platform administration and sent by email to our team (info@diskret.immo). You receive a confirmation of receipt by
email.

Voluntary disclosure to a partner agent: In the selling form you can separately consent to our passing on your
details to a partner agent in your region who will co-manage the sale. Without this tick we do not pass on your
details to any partner agent. The legal basis for the disclosure is your consent
(Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by email to
info@diskret.immo. We store the time of your consent as evidence (Art. 7(1) GDPR).

Legal basis: Art. 6(1)(b) GDPR, insofar as your request is aimed at a contract with us (brokerage mandate,
partnership, acquisition of a property); otherwise Art. 6(1)(f) GDPR (responding to enquiries).

Retention period: If no contract is concluded, we delete the incoming entry and the associated emails 24 months
after the last contact. If a mandate results, the periods in section 19 apply.

9. Account for buyers, owners and estate agents

Which data: role (buyer/investor, owner, estate agent), name, email address, password (stored only as an cryptographic hash), optionally company and telephone number, time of your confidentiality undertaking, status of the email
confirmation and of the account verification.

For what purpose: setting up and maintaining your account, storing search profiles, exposé requests and releases,
contacting you about your requests. Our team is informed by email about every registration so that it can verify the
account.

Email confirmation and verification: After registration we send a confirmation link to the address provided.
Only then can you request exposés. Before an exposé is released (stage B), our team confirms your identity
and your contact details in a callback; we note the result on the account.

Legal basis: Art. 6(1)(b) GDPR (user relationship via the platform). The notification of our team, the
verification by callback and the storage of the time of your confidentiality undertaking are additionally based on
our legitimate interest and that of the owners in preventing misuse and in being able to prove the undertaking
(Art. 6(1)(f) GDPR).

Retention period: as long as the account exists. We delete accounts, search profiles and uploaded documents 24
months after your last activity (login, request, change to a search profile). You can have your account deleted at any
time by email to info@diskret.immo. Statutory retention obligations remain unaffected (section 19).

10. Creating a buyer profile (with or without a document)

On the page „Create a buyer profile“ (Käuferprofil anlegen) you can register your search without a password.

Which data: name, email address, optionally company and telephone number, buyer type (private buyer, investor,
family office/fund/company, estate agent with a search mandate), your choice of property type, location and budget,
optionally your description in your own words and, if you wish, an uploaded acquisition profile (PDF, Word or text, up to 10 MB).

What happens to the document: We store the file on our server in a folder that cannot be accessed from the
internet. Our server automatically extracts the text (without external services), translates it into search criteria
according to fixed rules and stores the extracted text with the search profile. Only our team has access to the file
and the text. Please do not upload any documents containing identity, bank or health data or information about other
persons that is not necessary for your search.

Account and confirmation: We create a buyer account without a password for you or assign the profile to your
existing account. The profile becomes active only when you click the link in our confirmation email. Our team receives
an email with your details and the criteria identified.

Legal basis: Art. 6(1)(b) GDPR (you instruct us to propose suitable off-market properties to you).

Retention period: If you do not confirm the link, we delete the profile, document and account after
30 days. We delete confirmed profiles and documents 24 months after
your last activity, or earlier if you end the profile (an email to info@diskret.immo is sufficient).

11. Search profiles, matching with anonymous profiles and quiet market test

Search profiles: We store your search criteria, the original search text and the status (active/paused).

Matching: Our server regularly matches all active search profiles against the anonymous profiles and calculates a
match score from 0 to 100 with a short justification. The system reports new matches only to our team
(info@diskret.immo). You are not contacted automatically; if a property matches, a member of staff will contact you
personally.

Quiet market test and demand figures: For their property, owners and estate agents see only how many search
profiles match, and only from three onwards. On individual pages we likewise show aggregated figures (for example
search profiles per region), also only from three onwards. Owners and visitors do not learn any names or contact
details as a result.

Legal basis: Art. 6(1)(b) GDPR; matching and searching for suitable properties are the core of the service
you have asked us to provide. Section 12 applies to search profiles from our client base.

Retention period: until you delete the search profile or your account, at the latest 24 months after your last
activity.

12. Search profiles from the client base of IMMOBRA GmbH

In addition to diskret.immo, IMMOBRA GmbH runs its brokerage business at immobra.de. Anyone who has entrusted us with
their search there should also be offered suitable off-market properties. We therefore also keep search criteria from
our client base on diskret.immo. In all cases, the controller is the same IMMOBRA GmbH; the data does not leave
our company.

Origin and scope:

The data comes from you yourself or – in the case of acquisition profiles sent to us by a third party (for example an
intermediary or your employer) – from that sender. We do not use publicly accessible sources for this.

Purpose: matching your search against the anonymous profiles on diskret.immo so that we can offer you suitable
properties, and determining anonymous demand figures (section 11). These profiles have no account on diskret.immo and
receive no automatic emails. In the event of a match, our team will contact you through the usual channel.

Legal basis:
– Search mandates from immobra.de: your mandate to inform you about suitable properties (Art. 6(1)(b)
GDPR). Off-market offers on diskret.immo are offers of IMMOBRA GmbH and form part of this mandate. You can
end it at any time, for example via the unsubscribe link of the search agent; we then also delete the profile on
diskret.immo.
– Purchase requests from onOffice and acquisition profiles by email: the initiation of the brokerage contract or of
the business relationship that you have asked us for (Art. 6(1)(b) GDPR), and our legitimate interest in offering you
suitable properties from all our sales channels (Art. 6(1)(f) GDPR). The matching on diskret.immo serves the same
purpose for which you communicated your search to us. Insofar as this is regarded as a new purpose, it is compatible
with the original one (Art. 6(4) GDPR): it is still about offering you suitable properties; you could expect this
from us as an estate agent; the data consists of search criteria, not of particularly sensitive data; owners and
visitors see only aggregated figures from three onwards; for requests from onOffice and immobra.de, no names or
contact details are held on diskret.immo, only internal identifiers.

Your rights: You may object to your search profile being kept on diskret.immo at any time
(Art. 21 GDPR); an email to info@diskret.immo or info@immobra.de is sufficient. We will then delete the profile on
diskret.immo; you decide whether we should otherwise continue to process your request.

Retention period: We reconcile the data regularly. If a request ends in onOffice or on immobra.de, the profile on
diskret.immo is deactivated and deleted at the latest 24 months thereafter. Requests and acquisition profiles for which
there has been no contact for more than 24 months are kept on diskret.immo only if you have confirmed to us that your
search is still current; all others are deactivated and deleted within four weeks.

Support with the transfer: When extracting search criteria from the acquisition profiles received by email, we
were supported on a one-off basis by an AI service: Claude of Anthropic Ireland, Limited,
Dublin, Ireland, under a business contract (Team/Enterprise plan) with a data processing agreement
pursuant to Art. 28 GDPR. Anthropic was permitted to process the content only for this evaluation and not to use it
to train its models. In this context, data may also be processed by Anthropic, PBC (USA) and further
sub-processors in the USA; the transfer is safeguarded by EU standard contractual clauses
(Art. 46(2)(c) GDPR). In the process, the AI service processed the texts of the acquisition profiles,
including the names and contact details contained in them and in the email. From this, we stored on diskret.immo
the search criteria as well as the name and email address of the sender (see table).

13. Exposé requests, confidentiality and release stages

diskret.immo works in three stages:

• Stage A – anonymous profile: anonymous, without address and without information that makes the property
  identifiable.
• Stage B – exposé: after request, confidentiality undertaking, verification by callback and release.
• Stage C – address and documents: additionally after submission of proof of financing or proof of equity.

Request: If you request an exposé for an anonymous profile, we store the property, the time, your information on
financing (equity, financing confirmed, being clarified), your optional message, the status of the request
and the time and wording of the confidentiality undertaking you confirmed. Our team receives the request with your
name and email address.

Disclosure to the owner: The decision on the release is made by the owner or by the estate agent handling the
property (objektführender Makler; this may also be a partner agent). For this purpose we disclose to them your name
and, if provided, your company. This disclosure is a prerequisite for your request to be processed
(Art. 6(1)(b) GDPR). We inform you of the outcome by email.

Stage C: Before releasing the address and documents, we review your proof of financing or proof of equity
(for example a financing confirmation from your bank or proof of own funds). We use the proof only for
this review. As an estate agent, we are also obliged under the German Anti-Money Laundering Act (Geldwäschegesetz,
GwG) to identify the parties to a purchase contract as soon as there is a serious interest in purchasing
(§ 2(1) no. 14, §§ 10, 11(2) GwG). For this purpose we collect the information required by law (including name, place
of birth, date of birth, nationality, address, type, number and issuing authority of the identity document; for
companies, register details and beneficial owners) and make a copy of the identity document (§ 8(2) GwG).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request, brokerage contract);
identification under the Anti-Money Laundering Act: Art. 6(1)(c) GDPR; proof of the confidentiality undertaking:
Art. 6(1)(f) GDPR (protection of the owners and enforcement of the undertaking).

Retention period: exposé requests and the proof of your confidentiality undertaking until three years after the
end of the marketing of the property; proofs of financing until the end of the marketing; documents under the
Anti-Money Laundering Act five years (section 19).

14. Anonymous profiles, owner information and data of third parties (in particular tenants)

Owners: We create anonymous profiles from the information provided by the owners or by the estate agent handling
the property. An anonymous profile is published only anonymously and only once the owner’s consent has been
documented; for properties of a partner agent, additionally that agent’s written consent. The name and contact details
of the owners never appear in the anonymous profile. The legal basis is the brokerage contract or its initiation
(Art. 6(1)(b) GDPR).

Tenants and other third parties: For let properties, we receive information on tenancies from the owner (for
example start of tenancy, rent amount, floor area, names where applicable). We use it only for marketing the property.
In the exposé (stage B), tenant information appears without names; complete tenancy documents are received only by
buyers in stage C who have given a confidentiality undertaking. The legal basis is the legitimate interest of the owner
and the prospective buyer in a proper review before the purchase (Art. 6(1)(f) GDPR). The source of the data is the
owner or their estate agent. We delete the data after completion or termination of the marketing, unless there is a
retention obligation. Tenants can contact us with all rights set out in section 21.

15. Access log

What: We log events relevant to confidentiality: access to an anonymous profile, an exposé and an address
by logged-in users, exposé requests, releases and refusals, creation and confirmation of accounts and
search profiles, and form submissions. We store the time, a pseudonymous identifier of the account (a check value
that can be attributed to a person only with a key specific to the account), the property, the type of event and
technical additional information without content. Each line is chained to the previous one via a check value, so that
subsequent changes are detectable. If an account is deleted, we also delete its key; the entries can then no longer be
attributed to anyone.

For what purpose: protecting the confidentiality of the properties, proving who received which information and
when (for example in the event of disclosure contrary to the confidentiality undertaking or in questions of client
protection (Kundenschutz) between estate agents), and informing the owners of the number of accesses per stage.
Owners do not see names in the log.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest and that of the owners lies in the protection of
confidential information and in the assertion of and defence against claims.

Retention period: three years after the respective entry.

16. Email communication

We send confirmation and notification emails from WordPress via the plug-in „WP Mail SMTP“, which
sends the messages via the mail server of our hosting provider ALL-INKL.COM. Our mailbox info@diskret.immo is also
hosted by ALL-INKL.COM in Germany. We store emails for as long as is necessary to deal with your matter and beyond that
only insofar as they must be retained as business letters (section 19). If you reply to an email from the system, your
reply reaches our team.

17. Recipients

We do not sell data and do not pass it on for advertising purposes. The only recipients are:

• Owners or the estate agent handling the property for which you request an exposé (name and company,
  section 13).
• Partner agents, if you have consented to the disclosure in the selling form (section 8).
• Notary’s office (Notariat) for the preparation of a purchase contract, when the time comes and you so wish
  (Art. 6(1)(b) GDPR).
• Authorities, insofar as we are legally obliged, for example suspicious activity reports to the Zentralstelle für
  Finanztransaktionsuntersuchungen (Financial Intelligence Unit, FIU) pursuant to § 43 GwG (Art. 6(1)(c) GDPR).
• Processors acting on our instructions (Art. 28 GDPR): ALL-INKL.COM (hosting, mailbox and
  email dispatch, Germany) and onOffice GmbH, Aachen (brokerage software in which we keep purchase requests and client
  data).
• OpenStreetMap Foundation as an independent controller when the detail map is loaded (section 7).

Within IMMOBRA GmbH, only those employees who need the respective data for their tasks have access.

18. Transfers to third countries

We process your data in Germany. When the detail map is loaded, the OpenStreetMap Foundation in the
United Kingdom receives your IP address and the other information mentioned in section 7. For the United Kingdom
there is an adequacy decision of the EU Commission (Art. 45 GDPR), which currently applies until December 2031.
Whether the content delivery service provider used by the OSMF also processes data in other countries is beyond our
control (section 7). No further transfers to third countries take place.

19. Retention periods at a glance

The statutory periods each begin at the end of the calendar year in which the document was created or the
business relationship ended. After a period has expired, we delete the data. If it is still subject to a statutory
retention obligation, we restrict it from any other use until the obligation ends.

20. Obligation to provide data, no automated decision-making

You are under no statutory or contractual obligation to provide us with data. Without a name and email address,
however, we cannot set up an account or a buyer profile or answer a request; without the information required under
the Anti-Money Laundering Act, we are not permitted to act in stage C. Optional fields are marked as „optional“.

The match score between search profile and anonymous profile is a sorting aid for our team. Whether you receive an
exposé, an address or documents is decided by humans. No decision based solely on automated processing within the
meaning of Art. 22 GDPR takes place.

21. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent given at
any time with effect for the future (Art. 7(3) GDPR); the lawfulness of the processing carried out until then remains
unaffected. An informal message to info@diskret.immo is sufficient.

Right to object (Art. 21 GDPR): If we process your data on the basis of our legitimate interest
(Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no
longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your
interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to your
search profile from our client base being kept on diskret.immo (section 12) without giving reasons.

Right to lodge a complaint (Art. 77 GDPR): You may lodge a complaint with a data protection supervisory authority,
in particular in the Member State of your habitual residence, your place of work or the place of the alleged
infringement. The authority competent for us is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (Brandenburg State
Commissioner for Data Protection and for the Right of Access to Files), Stahnsdorfer Damm 77,
14532 Kleinmachnow, www.lda.brandenburg.de.

22. Artificial intelligence

No external AI service is currently switched on on diskret.immo. The search, the anonymous profile assistant and the
extraction of text from uploaded documents work exclusively on our server according to fixed rules. Your entries and
documents are not transmitted to anyone in the process. (For the one-off support with the transfer of the acquisition
profiles received by email, see section 12.) Before we use an AI service, we will supplement this policy.

23. Changes to this policy

We adapt this policy when our services or the legal situation change. The version published here with the
date stated above applies.