PRIVACY POLICY

1. Controller’s Name and Contact Information (Art. 4 No. 7 GDPR):

G & P Erste Management GmbH
Siesmayerstraße 21
D-60323 Frankfurt am Main

G & P Zweite Management GmbH
Siesmayerstraße 21
D-60323 Frankfurt am Main

G & P Dritte Management GmbH
Siesmayerstraße 21
D-60323 Frankfurt am Main

G & P Vierte Management GmbH
Siesmayerstraße 21
D-60323 Frankfurt am Main

Phone: +49 (0) 69 36 00 95-100
EMail:

Collectively referred to as the "Operating Companies."

2. Data Protection Officer

The Operating Companies have appointed an external data protection officer.

You can reach him as follows:

Groß & Partner
Grundstücksentwicklungsgesellschaft mbH
Data Protection Officer
Siesmayerstraße 21
60323 Frankfurt/Main

Email:

3. Collection and processing of personal data when visiting the website

You can generally visit our website without telling us who you are. However, our web servers automatically store technical information during your visit. This includes the type of web browser, the operating system, your IP address, your Internet service provider, the website from which you accessed us, the pages you visit on our site, as well as the date and duration of your visit. The processing of this data, particularly your IP address and the aforementioned data, is necessary to deliver the website. For this purpose, your IP address must be stored for the duration of the session. We do not combine this data with other data from other sources. The legal basis for this data processing to enable the use of the website is Art. 6 (1) (f) GDPR, as our legitimate interest lies in providing our services.

Furthermore, we only store and evaluate this data for statistical purposes in anonymised form and use it in this anonymised form to analyse the use of our offering and to further develop and optimise it. This is also based on Art. 6 (1) (f) GDPR. Our legitimate interest here is the ongoing improvement of our services to offer you the best possible user experience.

4. Type and scope of further data collection and processing

In some cases, we may need your personal data, such as:

• When providing our services, that is, operating a real estate development company and all related transactions;
• When you contact us;
• When you sign up for our newsletter to receive free information or participate in surveys.

a) Service provision and other inquiries

We only collect or process personal data when you voluntarily provide it to us, e.g., as part of an inquiry. In this case, your data, including the contact information you provide, will be stored and used to fulfil the purpose associated with its transmission, such as processing your inquiry and for any follow-up questions. The legal basis for storing and using this personal data is Art. 6 (1) (b) GDPR, provided you provide this data to initiate a contractual relationship with us. Only in this case is the submission of personal data necessary for a potential contract within the meaning of Art. 13 (2) (e) GDPR.

Otherwise, this storage and use is based on Art. 6 (1) (f) GDPR, as our legitimate interest is to carefully process your request.

If you commission us to provide a service or we use your services, we generally collect, store, and use your personal data only as far as it is necessary to provide the service or fulfil the contract. The legal basis for the related data processing is Art. 6 (1) (b) GDPR. It may also be necessary to transfer your personal data to companies we use to provide the service or process the contract. These could be, for example, transport companies or other service providers. Such transfers to our service providers are also based on Art. 6 (1) (b) GDPR.

In all cases where data processing serves the fulfilment of a contract, the provision of your personal data is required for the conclusion of the contract (see Art. 13 (2) (e) GDPR). Without your personal data, we cannot fulfil the contract.

b) Sending and evaluating the newsletter via MailChimp

With your consent, we are happy to send you our newsletter. To do this, you need to register for our newsletter. Details about the contents of the newsletter are provided in the consent form or on the registration page.

For the newsletter registration, we use the so-called double opt-in process. After registering, we will send an e-mail to the address you provided with a link you can click to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will not be used for the newsletter, and it will be deleted after one month. To prove your registration, we store the time of registration and confirmation, as well as your IP address at the time.

We also inform you that we evaluate your usage behaviour when sending the newsletter. The e-mails we send contain so-called web beacons or tracking pixels, which are single-pixel image files stored on our website. For the evaluation, we link the aforementioned data and web beacons to your e-mail address and an individual ID. Links in the newsletter also contain this ID. The data is collected exclusively in a pseudonymised manner, meaning the IDs are not linked to other personal data. This allows us to evaluate the general use of the newsletter and understand which content should be further improved based on user habits. This helps us tailor the newsletter to your specific needs and interests. You can prevent this evaluation by disabling the display of images in your e-mail program. In this case, the newsletter may not be displayed completely, and you may not be able to use all its functions.

Since the newsletter is only sent and evaluated with your consent, the legal basis for the related data processing is Art. 6 (1) (a) GDPR. You can revoke your consent and unsubscribe from the newsletter at any time. You can revoke it by clicking the link provided in each newsletter e-mail or by contacting us using the information provided in our imprint.

The newsletter is sent and evaluated using MailChimp, a service provided by The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA ("MailChimp"). For these purposes, MailChimp receives and processes the aforementioned information on our behalf. Additionally, MailChimp may use this data to optimize or improve its own services, such as improving the technical delivery of the newsletter or its display. For more information on how MailChimp handles your personal data, please visit: https://mailchimp.com/legal/privacy/.

MailChimp uses servers located in the USA. Any transfer of personal data to MailChimp in the USA is based on the European Commission's adequacy decision under Art. 45 GDPR, as MailChimp is certified under the EU-U.S. Data Privacy Framework, which attests certified companies an appropriate level of data protection under GDPR. Additionally, standard contractual clauses have been agreed with MailChimp to ensure the implementation of appropriate safeguards for specific cases. The standard contractual clauses can be found at: https://mailchimp.com/legal/data-processing-addendum/.

5. Will personal data be shared with third parties?

We only share your personal data with third parties if you have given us explicit consent, in line with Art. 6 (1) (a) GDPR. The only exceptions are transfers to our service providers or partners, such as technical service providers or payment processors, that we use to provide our services or online offerings. These data transfers are necessary for the performance of a contract, and take place under Art. 6 (1) (b) GDPR. In these cases, both we and our partners strictly comply with GDPR regulations. Before sharing any of your personal data, we ensure that our service providers and partners have implemented the necessary technical and organisational measures to safeguard your data. The amount of data shared is always limited to what is necessary.

We do not sell, rent, or otherwise make your data available to third parties.

Data may be shared with government authorities or institutions only to meet legal obligations, or if we are required to do so by a court order. In such instances, sharing your data is necessary to fulfil legal obligations under Art. 6 (1) (c) GDPR.

6. Use of cookies

In certain areas of our website, we use cookies or similar technologies (hereinafter collectively referred to as “cookies”). Cookies are small text files stored on your hard drive by websites. They do not harm your device and do not contain viruses. The cookies we use on our website do not collect personal data. They are designed to make your experience on our site easier and more tailored to your needs.

Most of the cookies we use are session cookies, which are deleted automatically after your visit (so-called session cookies). Some cookies, however, remain on your device beyond your current session (so-called persistent cookies). Persistent cookies allow us to recognize your browser the next time you visit our website. On this website, persistent cookies are stored for a maximum of two years before they are automatically deleted. You can also delete cookies manually in your browser’s settings at any time.

Cookies are typically classified based on their function as follows:

Necessary cookies: These cookies are essential for navigating the site, using its basic functions, and ensuring its security. They do not track your browsing activity for marketing purposes or log which other sites you visit. The legal basis for the use of necessary cookies is Section 25 (2) No. 2 TDDDG, as they are required for the safe operation of the site. Data processing associated with these cookies is based on Art. 6 (1) (f) GDPR, as we have a legitimate interest in providing a functional and secure website.

Preference Cookies, Statistics Cookies, and Marketing Cookies: With your consent, we may also use preference, statistics, or marketing cookies. These cookies, which are not strictly necessary, are used only with your explicit, active, and revocable consent in accordance with Section 25 (1) TDDDG. Further processing of the data collected via these cookies is based on your consent under Art. 6 (1) (a) GDPR. More detailed information about these cookies can be found in our cookie banner (where you can also manage your consent), as well as in the following specific sections of this privacy policy related to the services using cookies.

You have the right to withdraw your consent at any time with effect for the future. The validity of data processing up until the withdrawal remains unaffected. You can change your cookie settings whenever you wish. Manage cookie settings.

7. YouTube Videos

Our website may feature content, such as videos, from the YouTube platform. This service is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google Ltd.”), which is a subsidiary of Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

When you give us consent to use YouTube videos and view content from YouTube on our site, a connection is established with YouTube or Google servers, and they will receive your IP address. Additionally, information about your visit to our site is transmitted when you play a video. If you're logged into your YouTube account, this information may be linked to your personal profile. You can avoid this by logging out of your YouTube account before playing any videos. Data processing by YouTube or Google may also occur in third countries, including the US. Details on data protection at YouTube and Google, in particular on the type, scope and purpose of data processing, can be found at: https://policies.google.com/privacy.

Google also analyses video views and provides us with reports containing general insights, such as the total number of views. We do not receive detailed information about individual users. Videos are embedded using YouTube’s "enhanced privacy mode," which prevents YouTube from setting cookies to track user behaviour when the videos are accessed. Therefore, we believe that YouTube's analysis of video views does not track individual users in detail. However, Google carries out the general evaluation of videos automatically and independently, without us being able to deactivate or influence this or gain closer insight into the analyses.

We embed YouTube videos to offer informative content and enhance the user experience on our site. It also helps us assess video views for statistical purposes.

It is possible that while using YouTube, personal data could be transferred to Google servers in the US. For the US, the EU-U.S. Data Privacy Framework is an adequacy decision of the EU Commission, which attests that certified companies have an adequate level of data protection within the meaning of the GDPR. Google is certified under the EU-U.S. Data Privacy Framework and is also entered in the list maintained by the U.S. Department of Commerce (Data Privacy Framework List). A consistently high level of data protection is therefore guaranteed when data is transferred to Google servers in the US. Insofar as data is transferred to the US, such a third country transfer is based on Art. 45 (1) GDPR.

We only display YouTube content if you have given us your consent for data processing by YouTube or Google. The legal basis for this data processing is Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with effect for the future in the cookie settings.

Manage cookie settings.

8. Google Maps

Our website also features Google Maps, which allows us to display interactive maps. This service is provided by Google Ireland Limited, based in Dublin, Ireland, a subsidiary of Google LLC. in the US. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently.

When using Google Maps, information such as your device's IP address may be sent to and processed by Google servers in the US. Google may use this data to improve services, conduct market research, or personalise ads. If you are logged into your Google account, this data may be linked to your profile. To avoid this, you should log out of your Google account before using Google Maps. We do not have any control over this data processing by Google. Details on data protection at Google, in particular the type, scope and purpose of data processing, can be found here: https://policies.google.com/privacy.

As we have already explained, Google is certified under the EU-U.S. Data Privacy Framework and is also registered in the list maintained by the U.S. Department of Commerce (Data Privacy Framework List). A consistently high level of data protection is therefore guaranteed when data is transferred to Google servers in the US. Insofar as data is transferred to the US, such a third country transfer is based on Art. 45 (1) GDPR.

The legal basis for using Google Maps on our website is Art. 6 (1) (a) GDPR. The service allows us to visually present geographic information and offer interactive maps, improving user experience by making it easier to find our locations. You can withdraw your consent with effect for the future at any time through the cookie settings.

Manage cookie settings.

9. Google Analytics (with anonymisation function)

With your consent, we use Google Analytics (with anonymisation) on our website. Google Analytics is a web analytics service provided by Google Ltd., a subsidiary of Google. To simplify tool management, we use Google Tag Manager (see section 11 in the privacy policy for more information).

We use Google Analytics to track and analyse visitor traffic and behaviour on our website. This includes data such as the referring website (i.e., the site you visited before ours), access time, visit frequency, geographic location, and which parts of our website you interact with and for how long. These statistics and reports help us optimise and improve our website to make it more engaging for users.

Google Analytics uses cookies to enable an analysis of your use of the website. These cookies are stored on your device for a maximum of two years and are then automatically deleted. The information generated by these cookies about your use of the website is generally transmitted to a Google server in the US and stored there. Additionally, Google Analytics records your device's IP address to ensure the service's security and to help us determine the country, region or location our website is being accessed from (IP geolocation). We use Google Analytics exclusively with the anonymisation feature ("IP Masking"). By enabling this extension, your IP address is shortened within the EU or European Economic Area before being transmitted to a Google server in the US. Google uses this information on our behalf to evaluate your use of the website, compile reports on website activity, and provide additional services related to internet usage.

Google may also process the data collected through Google Analytics for its own purposes in accordance with its privacy policy. The data may be stored in user profiles and used for purposes such as improving products, developing new services, measuring the effectiveness of advertising, and personalising content and ads. If you are logged into your Google account, your data may be directly associated with your user profile. To prevent this, you can log out of your Google account before using Google Analytics. We have no control over how Google handles your data. For more details, refer to Google’s privacy policy at https://policies.google.com/privacy.

Further information on data processing by Google Analytics can be found at https://marketingplatform.google.com/about/analytics/terms/us/ and at https://support.google.com/analytics/answer/6004245?hl=en&sjid=4941015242310497237-EU

As we’ve mentioned, Google is certified under the EU-U.S. Data Privacy Framework and is listed in the U.S. Department of Commerce’s Data Privacy Framework List. This ensures a high level of data protection when data is transferred to Google’s servers in the US. Data transfers to the US are based on Art. 45 (1) GDPR.

We only use Google Analytics on our website with your consent. The legal basis for using Google Analytics cookies and accessing the stored data is Section 25 (1) TDDDG. The legal basis for subsequent data processing by Google Analytics is Art. 6 (1) (a) GDPR. You have the right to withdraw your consent at any time with future effect. The legality of data processing prior to withdrawal remains unaffected.

10. Google Marketing Platform

With your consent, we use the Google Marketing Platform (formerly DoubleClick) to optimise our statistical evaluations and marketing activities, including serving personalised ads in search engines, on Google sites and on Google’s partner sites ("Google Ad Network"), as well as measuring the effectiveness of our marketing efforts. The Google Marketing Platform is provided by Google Ltd., a subsidiary of Google.

The Google Marketing Platform evaluates the use of the contact form on our website and stores this information in user profiles. We have linked the Google Marketing Platform with Google Analytics 4 so that data collected via Google Analytics 4 (such as the submission of the contact form) can be transferred to the Google Marketing Platform. This provides us with more in-depth statistical insights and allows us to perform conversion tracking, for example by linking the information collected by Google Analytics 4 about the respective event (in this case the submission of the completed contact form) with advertising measures. This helps us measure the success of our campaigns, even if the user has not yet visited a page with a conversion tracking tag. Additionally, we can tailor our marketing efforts to your user profile, enabling us to deliver personalised ads.

When you access our website, your browser automatically establishes a direct connection with Google’s servers. We do not independently collect personal data, nor do we control the extent of data collection or processing by Google. According to our knowledge, Google collects information about your activities on our website, including your IP address, the date and time of your activity, and device information. Google may store this data in user profiles, which Google or third-party advertisers may use to display personalised ads on third-party sites. Google may also use the data to improve products, develop new services, measure the effectiveness of advertisements, and conduct market research. If you have a Google account, the data may be linked to your profile. If you don’t want this, you can log out of your Google account before using the platform. Even if you’re not logged in or don’t have a Google account, it’s still possible for Google to collect your IP address, time window and other identifying features and link them to the actions assigned to you. For more information on Google’s data processing, visit https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/ads?hl=en

It is possible that personal data may be transferred to Google server locations in the US when using the Google Marketing Platform. As noted earlier, Google LLC is certified under the EU-U.S. Data Privacy Framework and is listed in the U.S. Department of Commerce’s Data Privacy Framework List. Therefore, a high level of data protection is maintained when data is transferred to Google’s servers in the US. Data transfers to the US are based on Art. 45 (1) GDPR.

We only use the Google Marketing Platform with your consent. The legal basis for using cookies, as described above, is Section 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) (a) GDPR. You have the right to withdraw your consent at any time with future effect. The legality of data processing prior to withdrawal remains unaffected.

11. Google Tag Manager

Our website uses Google Tag Manager, a service provided by Google Ltd., a subsidiary of Google. This tool allows us to manage website tags from one interface. Google Tag Manager itself doesn’t use cookies and does not collect any personal data. It merely triggers other tags, which may collect data. However, Google Tag Manager doesn’t access that data. If cookies or tracking have been disabled at the domain or cookie level, this setting will apply to all tags managed through Google Tag Manager.

For more information on data protection, visit:

• Privacy Policy: Privacy Policy – Privacy & Terms – Google
• Google Tag Manager FAQ: Tag Manager Help
• Google Tag Manager Terms of Use: Google Tag Manager Use Policy | Google Tag Manager – Google

12. Google Fonts

Our website uses web fonts provided by Google Fonts to enhance and improve the appearance of the text. This helps us ensure that the website is visually optimised and user-friendly. When you visit our site, your browser automatically loads the necessary web font into its cache. If your browser doesn’t support this feature, a default font from your computer will be used instead.

We host these Google Fonts on a local server within the European Economic Area, meaning that no data is transmitted to Google when you access our site.

The legal basis for using Google Fonts and the associated data processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in optimising the website for an improved user experience.

13. Cookiebot

We use the consent management tool Cookiebot, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark ("Usercentrics"). This tool helps us provide a cookie banner to inform visitors about the optional cookies used on our website, allow them to adjust their cookie settings, and document any consents given.

When you visit our site, Cookiebot displays information and options for managing the optional cookies we use. During this process, a connection is made with the tool provider’s server, and technical data such as your device type (e.g., operating system, browser version, language, and IP address), the URL of the visited site, approximate location, and your chosen cookie settings (cookie categories, date, and time) are transmitted to Usercentrics. This data is stored only as long as necessary to document your consent.

Your cookie settings are stored in a browser cookie with a unique consent ID, allowing your settings to be remembered between visits. This prevents you from needing to adjust your preferences each time you return to our website. The cookie has a maximum storage period of two years, after which it is automatically deleted.

Usercentrics stores the collected data on servers within the European Union. However, since Usercentrics uses service providers located outside the EU and EEA (such as in the US.), data transfers to third countries may occasionally occur. To ensure adequate data protection, Usercentrics only transfers data to countries that the European Commission has recognized as having an adequate level of protection (e.g., the EU-U.S. Data Privacy Framework, under which the service provider is certified) or to recipients that have agreed to the European Commission’s standard contractual clauses. These transfers are based on Art. 45 GDPR or Art. 46 (2) (c) GDPR.

We have signed a data processing agreement with Usercentrics regarding the use of Cookiebot. The data collected by Usercentrics is processed according to our instructions, in compliance with Art. 28 GDPR.

The legal basis for setting the Cookiebot cookie is Section 25 (2) No. 2 TDDDG, and the subsequent data processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest is to provide you with a compliant and user-friendly website where you can easily manage your cookie preferences. Setting the Cookiebot cookies is therefore absolutely necessary.

14. Automated Decision-Making

We do not use any automated decision-making processes, including profiling, as defined by Art. 22 (1) and (4) GDPR.

15. No Obligation to Provide Personal Data

You are not legally or contractually required to provide us with your personal data. However, please note that certain services may be limited or unavailable if the necessary data is not provided (see section 4a).

16. Security

We employ appropriate technical and organisational security measures, as outlined in Art. 32 GDPR, to ensure the adequate protection of your data managed by us. These measures safeguard your data against accidental or intentional manipulation, loss, destruction, or unauthorised access. We continuously improve these security measures in line with technological advancements. Your data is stored solely on secure systems within Germany. Only authorised personnel, bound by confidentiality agreements, have access to this data for technical, administrative, or editorial purposes.

17. Data Retention and Deletion

We retain your personal data only for as long as necessary to fulfil the intended purpose (e.g., fulfilling a contract or answering your inquiry) or for legitimate reasons within the meaning of Art. 17 (3) GDPR, such as statutory retention periods, which make storage necessary. As long as statutory retention obligations, such as tax and commercial law regulations, prevent the deletion of your personal data, we will restrict the processing of your data. Once the retention period has expired, your data will be deleted in compliance with legal requirements.

18. Your Rights

You have the right to request information at any time regarding the personal data we have stored about you, the purposes for which it is processed, its source, and the recipients or categories of recipients to whom your data has been disclosed. You may also inquire about how long your data will be stored and the rights available to you as a data subject. We will provide this information free of charge in writing or electronically.

Furthermore, you have the right to request the correction of inaccurate data, the deletion of your personal data (unless there are legitimate reasons preventing this), or the restriction of its processing. If the data is required to provide services to you, deletion or restriction will only be possible after you stop using our services or offerings.

You also have the right to object, at any time, to data processing based on Art. 6 (1) (f) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, or if the processing is for the establishment, exercise, or defense of legal claims. You may also object at any time to the processing of your data for direct marketing purposes without providing any specific reason.

If we process data based on your consent or to fulfil a contract, you may request that we provide you with this data in a structured, commonly used, and machine-readable format, or that we transfer this data to another data controller, if technically feasible (so-called right to data portability).

You may revoke any consent you have given for the use of your personal data at any time with future effect.

Additionally, you have the right to lodge a complaint with a supervisory authority if you believe that our processing of your data violates any legal provisions.

To exercise any of these rights, please contact us at the address provided above, or e-mail our data protection officer at .

19. Scope of this Privacy Policy

This privacy policy only applies to our services and the data processing carried out on the servers we use. It does not cover the content or websites of third parties to which our services may link. For example, this includes social networks like Facebook and Twitter (now "X"). The processing of your personal data on these social networks is handled by the network operators, over which we have no control. This also applies to any personal data you share with us through such platforms, such as by messaging our profile on these social networks. For details on how your personal data is handled and protected on these platforms, please consult their respective privacy policies.

However, if we store your personal data that you’ve shared with us via a social network or data we receive from a social network on our own servers - for instance, to handle your inquiry or for other purposes - then our privacy policy will apply to that data.

20. Revisions to this Privacy Policy

We reserve the right to review and update this privacy policy as necessary due to new technological developments, changes in legal rulings, or updates to our business operations. We recommend reviewing this privacy policy from time to time to ensure you are aware of how we collect, process, and use your personal data.