Data Protection

  1. Name and contact details of the data controller

    This data protection information applies to data processing by:

    LDP Immobilienberatung GmbH
    Tölzer Str. 1,
    82031 Grünwald
    Phone: +49 151 44232770

 Email: info@ldp.group The responsible body is the natural or legal person who, alone or together with others, decides on the purposes and means of processing personal data (e.g. names, e-mail addresses, etc.).

  2. Definitions

    The data protection declaration of our website is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration should be legible and understandable for the general public as well as for our customers and business partners. To ensure this, we would like to explain the terms used in advance.

    Personal data:

    Personal data is any information relating to an identified or identifiable natural person (hereinafter “data subject”). A natural person is considered to be identifiable if, directly or indirectly, in particular by means of assignment to an identifier such as a name, an identification number, location data, an online identifier or to one or more special features, the expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person can be identified.

    Affected person:

    Data subject is any identified or identifiable natural person whose personal data is processed by the data controller.

    Processing:

    Processing is any process carried out with or without the help of automated procedures or any such series of processes in connection with personal data such as collecting, recording, organizing, structuring, storing, adapting or changing, reading out, querying, using, disclosure by transmission, distribution or any other form of making available, matching or linking, restriction, deletion or destruction.

    Restriction of processing:

    Restriction of processing is the marking of stored personal data with the aim of restricting their future processing.

    Profiling:

    Profiling is any type of automated processing of personal data that consists in using this personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, conduct, whereabouts or relocation.

    Pseudonymization:

    Pseudonymization is the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the use of additional information, provided that this additional information is stored separately and is subject to technical and organizational measures that ensure that the personal data is not assigned to an identified or identifiable natural person.

    Processor:

    Processor is a natural or legal person, authority, institution or other body that processes personal data on behalf of the person responsible.

    Recipient:

    Recipient is a natural or legal person, public authority, institution or other body to which personal data is disclosed, regardless of whether it is a third party or not. However, authorities that may receive personal data in the context of a specific investigation mandate under Union or Member State law are not considered recipients.

    Third party:

    Third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct responsibility of the controller or the processor, are authorized to process the personal data.

    Consent:

    Consent is any expression of will voluntarily given by the data subject in an informed manner and unequivocally for the specific case in the form of a declaration or other clear confirmatory action with which the data subject indicates that they consent to the processing of their personal data.

  3. Collection and storage of personal data and the type and purpose of their use

    1. When visiting the website

    When you open ldp.group, your browser automatically sends technical information to the server that delivers the page. This information is written to a server log and includes the IP address of the requesting device, the date and time of the request, the address of the page requested, the page from which you came (referrer), the browser type and version and the operating system. We use this data to deliver the website to your device, to keep the website secure and stable and to detect and block abuse. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a secure and functioning website). Server logs are processed by our hosting provider (see Hosting) and are not merged with other data about you. We do not keep these logs ourselves and have no access to raw access logs; Cloudflare processes them on our behalf for delivery and security and deletes them under its data processing addendum once they are no longer needed for these purposes.

  4. Sharing of Data

    Your personal data will not be transmitted to third parties for purposes other than those listed below. We only pass on your personal data to third parties if

    • you have given your express consent (Art. 6(1)(a) GDPR),
    • the transfer is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data (Art. 6(1)(f) GDPR),
    • there is a legal obligation to pass it on (Art. 6(1)(c) GDPR), or
    • this is legally permissible and required for the performance of a contract with you or for pre-contractual measures (Art. 6(1)(b) GDPR).

    Recipients and processors

    We use the following service providers. Providers marked as processors act only on our instructions under a data processing agreement pursuant to Art. 28 GDPR.

    • Cloudflare (hosting, content delivery, security, cookie banner with Cloudflare Zaraz, Cloudflare Web Analytics): processor, see Hosting.
    • Celonis with its automation service Make (receiving the calculation and rate update forms): processor.
    • Resend (sending confirmation e-mails, calculations and the rate update): processor.
    • Close (customer relationship management for enquiries and confirmed contacts): processor.
    • Google Ireland Limited (Google Analytics 4, only with your consent): processor under Google's data processing terms.
    • Trustpilot A/S and Trustindex Ltd (review widgets): receive your IP address when the widget loads, see Review widgets.
    • Google Ireland Limited for YouTube (videos, only after you press play): responsible for the data processing that starts when you play a video, see YouTube videos.
    • Framer B.V. and Perspective Software GmbH (the eligibility check and application form on go.ldp.group), Calendly LLC (booking a call): processors, see the section on go.ldp.group.
    • Google Ireland Limited, Meta Platforms Ireland Limited and TikTok Technology Limited (advertising measurement on go.ldp.group, only with your consent), see the section on go.ldp.group.

    Details on each provider, including transfers to the USA, are given in the sections below.

  5. Hosting

    Cloudflare

    This website is delivered as a static website through Cloudflare Pages and the Cloudflare content delivery network. Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA; for customers in the EU the contracting entity is Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany. When you open a page, your request is routed through a Cloudflare data centre, which processes the data described under "When visiting the website" (in particular your IP address) to deliver the page, to protect the website against attacks and to cache content close to you. Cloudflare may transfer data to the USA; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, and Cloudflare's Data Processing Addendum with the EU standard contractual clauses forms part of our contract. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a secure, fast and reliable delivery of the website). Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.

    Eligibility check and application form on go.ldp.group

    Our eligibility check and application form run on the separate address go.ldp.group, which we operate. The page is built with the website builder Framer (Framer B.V., Netherlands) and the form software Perspective (Perspective Software GmbH, Berlin, Germany), set up for us by our marketing agency. This section is the privacy information for go.ldp.group.

    What we process: the answers you give in the form (for example your residence status, income range, equity and plans), your name, e-mail address and phone number, the time of your entry, and the technical parameters in the link that tell us which page and which source brought you there. Purpose and legal basis: to check whether a purchase could work for you and to contact you about it, Art. 6(1)(b) GDPR (steps at your request before a contract). Your entry is passed through Make (Celonis) to our CRM Close; if you book a call, the booking runs through Calendly (Calendly LLC, USA). These providers process the data on our behalf. We keep your entry for as long as we need it for your enquiry and any resulting contract; after that we delete it unless statutory retention periods apply.

    Cookies and advertising measurement on go.ldp.group: the page asks for your consent with the consent tool Cookiebot (Usercentrics A/S, Denmark). Only if you agree are the following loaded: Google Analytics 4 and Google Ads conversion measurement and remarketing (Google Ireland Limited), the Meta Pixel (Meta Platforms Ireland Limited) and the TikTok Pixel (TikTok Technology Limited, Ireland). They set cookies such as _ga, _gcl_au, _fbp and _ttp for up to about 13 months, measure which of our ads lead to an enquiry and can be used to show you our ads on these platforms. The providers may transfer data to the USA and other countries outside the EU; Google and Meta are certified under the EU-US Data Privacy Framework, and otherwise the EU standard contractual clauses apply. The legal basis is your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future via the Cookiebot icon on the page.

  6. Cookies and inquiries by e-mail, telephone or fax

    Cookies

    We use cookies only in the following cases. First, a technically necessary cookie named cf-consent stores the choice you make in our cookie banner, so that we do not have to ask you again on every page. It contains no personal data and no identifier that could be used to recognise you elsewhere and is stored for one year. Second, Cloudflare Zaraz, which runs the cookie banner, sets a technical cookie named cf_zaraz_client; in our configuration it contains no value and no identifier and expires after one year. The legal basis for both is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. Third, analytics cookies are set only if you agree to them in the cookie banner; they are described under Google Analytics 4 below. You can change or withdraw your choice at any time via the cookie settings link, which reopens the banner, or by deleting cookies in your browser. On ldp.group no cookies are set for advertising, and we do not use tracking pixels of social networks; for go.ldp.group see the section on the eligibility check and application form.

    Inquiry by e-mail, telephone or fax

    If you contact us by e-mail, telephone or fax, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of processing your request. We do not pass on this data without your consent. This data is processed on the basis of Article 6 (1) (b) GDPR if your request is related to the fulfillment of a contract or is necessary to carry out pre-contractual measures. In all other cases, the processing is based on your consent (Art. 6 Para. 1 lit. a GDPR) and/or on our legitimate interests (Art. 6 Para. 1 lit. f GDPR), since we have a legitimate interest in the effective processing of inquiries addressed to us. The data you sent to us via contact requests will remain with us until you request deletion, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory legal provisions, in particular statutory retention periods, remain unaffected: if your inquiry leads to a contract, we keep the related correspondence and records for as long as commercial and tax law requires (Section 257 HGB, Section 147 AO; generally six to ten years).

    Job applications

    If you apply for a job by e-mail to info@ldp.group, we process the data you send us (contact details, CV, certificates and cover letter) to decide on your application. The legal basis is Art. 6(1)(b) GDPR (steps before an employment contract). Only the people involved in the hiring decision see it. If we do not hire you, we delete your application six months after our decision, because we may need it to answer claims under the General Equal Treatment Act (Section 15(4) AGG, Section 61b ArbGG); we keep it longer only with your consent. If we hire you, it becomes part of your personnel file.

    Your calculation by e-mail and the German mortgage rate update

    On our calculators and on our mortgage rate pages you can ask us to e-mail you your calculation and/or to send you our German mortgage rate update every second Tuesday. We use the double opt-in procedure: after you enter your e-mail address we send you a confirmation link, and only when you open it and press the confirm button do we send the calculation, add you to the rate update list and record the request.

    What we process: your e-mail address; for a calculation, the name of the calculator and the values and results it showed at that moment (for example purchase price, equity, interest rate); the page you used; the times of your request and of your confirmation; and, if our first-party attribution script has stored it in your browser, the channel through which you first came to our website (for example a search engine, an AI assistant or a direct visit) and your first landing page. We do not ask for your name.

    Purposes and legal bases: sending the calculation you asked for (Art. 6(1)(b) GDPR); the rate update, which we send only with your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG); documenting your consent and recording your request in our customer relationship management system, so that we know the context if you contact us later (Art. 6(1)(f) GDPR; our legitimate interest is proof of consent and the orderly handling of enquiries). Contacts from these forms are marked separately in our CRM.

    Service providers: the form data is received and processed by Make, an automation service of Celonis (Celonis Inc., One World Trade Center, New York, USA, and its subsidiaries). The e-mails are sent and the rate update list is managed with Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, USA; the e-mails are sent from its EU region in Ireland). Confirmed contacts are recorded in our CRM Close (Elastic Inc., 111 Congress Avenue, Austin, Texas, USA). These providers process the data on our behalf under data processing agreements. Where data is transferred to the USA, the transfer is based on the EU-U.S. Data Privacy Framework for certified providers and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

    Storage period and withdrawal: unconfirmed requests are deleted automatically after 7 days. The calculation values are removed from our opt-in record as soon as the e-mail has been sent. We keep the confirmation record (e-mail address, times of request and confirmation) for as long as you receive the rate update and for up to three years after you unsubscribe, as proof of your consent. You can unsubscribe at any time with the link in every rate update or by writing to info@ldp.group; this does not affect the lawfulness of the processing before your withdrawal.

  7. Consent management, web analytics and third-party content

    1. Consent management (Cloudflare Zaraz)

    We use the consent management function of Cloudflare Zaraz, a service of Cloudflare (see Hosting), to obtain and store your consent before any analytics tool is loaded. Zaraz shows the cookie banner, remembers your decision in the cf-consent cookie and loads a tool only after you have agreed to the purpose it belongs to. If you reject, no analytics script is loaded and no analytics data is transmitted. The legal basis for the consent management itself is Art. 6(1)(c) and (f) GDPR (our obligation to obtain and document consent). You can reopen the banner at any time via the cookie settings link.

    2. Cloudflare Web Analytics

    We use Cloudflare Web Analytics to count how many visitors our pages receive. This service works without cookies and without any persistent identifier stored on your device. A small script sends the address of the page, the referrer, the browser type and the approximate performance of the page load to Cloudflare, which aggregates this information into statistics. Your IP address is used to determine the country of the request and is not stored in the statistics. Because nothing is stored on or read from your device, no consent under Section 25 TDDDG is required; the legal basis is Art. 6(1)(f) GDPR (our legitimate interest in knowing how the website is used). Provider and transfer details: see Hosting.

    3. Google Analytics 4

    Only if you agree in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies (_ga and _ga_FLW8EBRBTF, each stored for up to two years) to distinguish visitors and sessions and records which pages you view, how you arrived at the website, the approximate region, your device and browser type and interactions such as clicks on outbound links. Google Analytics does not log or store your IP address; it is used only to derive an approximate location and is then discarded. We have activated the data processing terms offered by Google, deactivated Google Signals and advertising features, and set the retention period for user-level data to 14 months. Our website and the application form on go.ldp.group are measured as one visit, so that we can see which pages lead to an enquiry. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework and the EU standard contractual clauses apply in addition. The legal basis is your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings link. Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

    4. Review widgets (Trustpilot, Trustindex)

    On our home page we display our customer reviews from the review platform Trustpilot through a widget of Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark. On our testimonials page we display Google reviews through a widget of Trustindex Ltd, Nyari Pal utca 15, 2724 Ujlengyel, Hungary. To show the reviews, your browser loads the widget script from the provider's servers, which means the provider receives your IP address and the address of the page you are viewing. The widgets do not set cookies on our website. On the testimonials page the reviewers' profile pictures are not loaded from Google; we show their initials instead, so the widget does not make your browser connect to Google's servers. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in showing verified customer reviews). Privacy policies: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms and https://www.trustindex.io/privacy-policy/.

    5. YouTube videos

    Our testimonials page and our client cases page show videos from YouTube, a service of Google Ireland Limited (address above). The videos are not loaded when you open a page: we only show a preview image from our own server, and no connection to YouTube or Google is made. Only when you press play is the YouTube player loaded in privacy-enhanced mode (youtube-nocookie.com); the play button says so before you click. From that moment Google receives your IP address and the address of the page, may store information on your device and set cookies of its own, and may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. The legal basis is your consent, given by pressing play (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google's privacy policy: https://policies.google.com/privacy.

  8. Plugins and fonts

    Web fonts

    For a uniform appearance this website uses the fonts Montserrat and Roboto, published by Google under the SIL Open Font License, together with two licensed fonts. All font files are stored on our own hosting and delivered from ldp.group. No connection to Google's font servers is established when you visit this website.

  9. Updating/Deleting Your Personal Information

    You can review, change or delete the personal information that has been provided to us at any time by emailing us.
    You also have the right to withdraw your consent at any time with effect for the future.
    The stored personal data will be deleted if you revoke your consent to storage.
    The person responsible for processing processes and stores the personal data of the data subject only for the period necessary to achieve the purpose of storage or if this is required by the European legislator for directives and regulations or another legislator in laws or regulations to which the person responsible for processing is subject. If the purpose of storage no longer applies or if a storage period prescribed by the European directive and regulation giver or another responsible legislator expires, the personal data will be blocked or deleted as a matter of routine and in accordance with the statutory provisions.

    Storage periods at a glance

    • Server logs: we keep none ourselves; Cloudflare deletes them once they are no longer needed for delivery and security (see Hosting).
    • Inquiries by e-mail, telephone or fax: until your request has been dealt with; if it leads to a contract, for the statutory retention periods (generally six to ten years).
    • Calculation by e-mail and rate update: unconfirmed requests 7 days; calculation values until the e-mail has been sent; confirmation record as long as you receive the rate update and up to three years after you unsubscribe.
    • Cookie cf-consent: one year. Cookie cf_zaraz_client: one year.
    • Google Analytics cookies (only with consent): up to two years; user-level data in Google Analytics: 14 months.
    • First-visit record in your browser's local storage (ldp_ft: first channel, first landing page and time; no name, no e-mail address): 90 days.
    • Entries in the eligibility check on go.ldp.group: as long as needed for your enquiry and any resulting contract, then deleted unless statutory retention periods apply. Advertising cookies there (only with consent): up to about 13 months.
    • Job applications: six months after our decision, unless you agree to a longer period or we hire you.

  10. Rights of data subjects

    Each data subject has the right, granted by the European directive and regulation giver, to request confirmation from the data controller as to whether personal data relating to them is being processed. If a data subject wishes to make use of this right of confirmation, they can contact us at any time.
    Any person affected by the processing of personal data has the right, granted by the European directive and regulation giver, to request free information from the person responsible for processing about the personal data stored about him and a copy of this information at any time obtain. Furthermore, the European legislator for directives and regulations has granted the data subject access to the following information:

    • the processing purposes
    • the categories of personal data being processed
    • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
    • if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
    • the existence of a right to correction or deletion of the personal data concerning you or to restriction of processing by the person responsible or a right to object to this processing
    • the existence of a right of appeal to a supervisory authority
    • if the personal data is not collected from the data subject: All available information about the origin of the data
    • the existence of automated decision-making including profiling in accordance with Article 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved and the scope and intended effects of such processing for the data subject

    Furthermore, the data subject has a right to information as to whether personal data has been transmitted to a third country or to an international organization. If this is the case, the person concerned has the right to receive information about the appropriate guarantees in connection with the transmission. If a data subject wishes to exercise this right to information, they can contact us at any time.
    Any person affected by the processing of personal data has the right granted by the European legislator for directives and regulations to demand the immediate correction of incorrect personal data concerning them. Furthermore, the data subject has the right, taking into account the purposes of the processing, to request the completion of incomplete personal data – also by means of a supplementary declaration. If a data subject wishes to exercise this right to rectification, they can contact us at any time.
    Any person affected by the processing of personal data has the right granted by the European directive and regulation giver to demand that the person responsible delete the personal data concerning them immediately if one of the following reasons applies and as far as the processing is not necessary:

    • The personal data were collected for purposes or otherwise processed for which they are no longer necessary.
    • The data subject revokes their consent on which the processing was based pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR and it is missing to another legal basis for the processing.
    • The data subject objects to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate reasons for the processing, or the data subject objects to the processing pursuant to Art. 21 Para. 2 GDPR.
    • The personal data was processed unlawfully.
    • The erasure of the personal data is necessary for compliance with a legal obligation in Union or Member State law to which the controller is subject.
    • The personal data was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

    If one of the above reasons applies and a data subject wishes to have personal data stored by us deleted, they can contact us at any time. We will comply with the request for deletion immediately.
    If the practice has made the personal data public and our company, as the person responsible, is obliged to delete the personal data in accordance with Art. 17 (1) GDPR, we shall take into account the available technology and the Implementation costs appropriate measures, also of a technical nature, to inform other persons responsible for data processing who process the published personal data that the person concerned has requested the deletion of all links to this personal data or copies by these other persons responsible for data processing or has requested replications of this personal data, insofar as the processing is not necessary.
    Any person affected by the processing of personal data has the right granted by the European legislator for directives and regulations to require the person responsible to restrict the processing if one of the following conditions is met

    • The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data.
    • The processing is unlawful, the data subject refuses the deletion of the personal data and instead requests the restriction of the use of the personal data.
    • The person responsible no longer needs the personal data for the purposes of processing, but the data subject needs them to assert, exercise or defend legal claims.
    • The data subject has lodged an objection to the processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

    If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by us, they can contact us at any time. We will arrange for the processing to be restricted.
    Any person affected by the processing of personal data has the right granted by the European legislator for directives and regulations to receive the personal data relating to them, which the person concerned provided to a person responsible, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another person in charge without hindrance from the person in charge to whom the personal data was provided, provided that the processing is based on consent pursuant to Art. 6 Para. 1 Letter a) GDPR or Art. 9 Paragraph 2 letter a) GDPR or on a contract in accordance with Article 6 paragraph 1 letter b) GDPR and the processing is carried out using automated procedures, provided that the processing is not necessary for the performance of a task that is in the public interest lies or takes place in the exercise of official authority, which has been transferred to the person responsible.
    Furthermore, when exercising their right to data portability in accordance with Art. 20 (1) GDPR, the data subject has the right to obtain that the personal data is transmitted directly from one person responsible to another person responsible, insofar as this is technically feasible and provided that this does not affect the rights and freedoms of other persons.
    The person concerned can contact us at any time to assert the right to data portability.
    Any person affected by the processing of personal data has the right granted by the European directive and regulation giver, for reasons arising from their particular situation, at any time against the processing of personal data concerning them, which is due to Art. 6 para. 1 letter e) or f) GDPR takes place to file an objection. This also applies to profiling based on these provisions.
    In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which outweigh the interests, rights and freedoms of the data subject or the processing, assertion, serve to exercise or defend legal claims.
    If we process personal data in order to operate direct advertising, the person concerned has the right to object at any time to the processing of personal data for the purpose of such advertising. This also applies to profiling insofar as it is associated with such direct advertising. If the data subject objects to the processing for direct marketing purposes, we will no longer process the personal data for these purposes.
    In addition, the data subject has the right, for reasons arising from their particular situation, against the processing of personal data relating to them, which we use for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR to object, unless such processing is necessary to fulfill a task in the public interest.
    To exercise the right to object, the data subject can contact us directly.
    In connection with the use of information society services, the data subject is also free, notwithstanding Directive 2002/58/EC, to exercise his or her right to object by automated means using technical specifications.
    Any person affected by the processing of personal data has the right granted by the European directive and regulation giver not to be subject to a decision based solely on automated processing – including profiling – which has legal effect on him or her or significantly affects them in a similar way, provided that the decision
    a) is not necessary for entering into, or the performance of, a contract between the data subject and a data controller, or
    b) is permissible on the basis of Union or Member State legislation to which the person responsible is subject and this legislation contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject or
    c) with the express consent of the data subject.
    Is the decision
    a) necessary for entering into, or the performance of, a contract between the data subject and the data controller, or
    b) it takes place with the express consent of the data subject, we shall take appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain human intervention of the person responsible, to present your own point of view and to contest the decision.
    If the data subject wishes to assert rights relating to automated decisions, they can contact us at any time.
    Any person affected by the processing of personal data has the right granted by the European legislator for directives and regulations to revoke consent to the processing of personal data at any time.
    If the data subject wishes to assert their right to withdraw consent, they can contact us at any time.
    In the event of violations of the GDPR, those affected have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged violation. The right to lodge a complaint is without prejudice to other administrative or judicial remedies. The supervisory authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

  11. Art. 6 Para. 1 Letter a) GDPR serves our company as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary to fulfill a contract to which the data subject is a party, as is the case, for example, with processing operations that are necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Art. 6 para. 1 letter b) GDPR. The same applies to such processing operations that are necessary to carry out pre-contractual measures, for example in the case of inquiries about our products or services. If our company is subject to a legal obligation which necessitates the processing of personal data, such as the fulfillment of tax obligations, the processing is based on Art. 6 Para. 1 Letter c) GDPR. In rare cases, the processing of personal data could become necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured in our company and his name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6 Para. 1 Letter d) GDPR. Ultimately, processing operations could be based on Art. 6 Para. 1 Letter f) GDPR. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to protect a legitimate interest of our company or a third party, provided that the interests, fundamental rights and fundamental freedoms of the person concerned do not prevail. Such processing operations are permitted to us in particular because they have been specifically mentioned by the European legislator. In this respect, he took the view that a legitimate interest could be assumed if the data subject is a customer of the person responsible (recital 47 sentence 2 GDPR).

  12. Data protection officer and contact

    We are not legally required to appoint a data protection officer (Art. 37 GDPR, Section 38 BDSG) and have not appointed one. For any question about data protection, and to exercise your rights, please contact LDP Immobilienberatung GmbH, Tölzer Str. 1, 82031 Grünwald, info@ldp.group.

  13. Data Security

    Our website is delivered only over encrypted HTTPS connections (TLS). You can tell that a page is transmitted in encrypted form by the lock symbol and the https:// prefix in your browser's address bar. We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

  14. Updating and changing this data protection declaration

    This data protection declaration is currently valid and has the status of September 2026. Due to the further development of our website and offers or due to changed legal or official requirements, it may become necessary to change this data protection declaration. You can access and print out the current and valid data protection declaration from this website at any time.

Shape