Privacy.

Dr. Hofeditz Real Estate GmbH
Am Klein Flottbeker Bahnhof 55, 22609 Hamburg
Represented by its Managing Director Dr Marcel Hofeditz
Phone: +49 1515 046 7537
Email: marcel@dr-hofeditz.de

We process our users’ personal data only insofar as this is necessary to provide the Offmarketpool platform, its functions and the services you request, or where you have given your consent. Below we inform you about the individual processing activities, their purposes and legal bases (Art. 6(1) GDPR).

The platform is hosted by Vercel Inc., 650 California St, San Francisco, CA 94108, USA (“Vercel”) and delivered via its content delivery network. When pages are accessed, Vercel processes technically necessary data on our behalf (IP address, date and time of access, URL accessed, user agent, referrer) in server log files in order to ensure the delivery, stability and security of the platform. The legal basis is our legitimate interest in the secure and efficient operation of the platform (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel. Processing may also take place on servers in the USA; Vercel is certified under the EU-US Data Privacy Framework, and EU standard contractual clauses are also in place.

We use Vercel Web Analytics and Vercel Speed Insights to statistically evaluate the use and loading speed of the platform. These services operate without cookies: no cookies are set and no cross-device profiles are created; IP addresses are not stored permanently, and visitors are only distinguished by a short-lived hash derived from the request. The legal basis is our legitimate interest in analysing and improving the platform (Art. 6(1)(f) GDPR).

In addition, we measure ourselves through which channel visitors reach the platform (e.g. search engine, social networks, advertisement, partner link). For each visit we store only the campaign parameters from the link (utm parameters, the type of an ad click ID but not its value), the host of the referring page, the landing page, the country and the device type – no IP address and no user agent. For this purpose we store a random session identifier in your browser (sessionStorage, ending with the tab) and, for a maximum of 30 days, the origin of your first visit (localStorage, no device ID). If you register, we assign this origin and your answer to “How did you hear about us?” to your account in order to evaluate our advertising and channels. The legal basis is our legitimate interest in analysing and improving our reach (Art. 6(1)(f) GDPR); you can delete this data in your browser at any time.

When you register, we collect your name, email address, company, telephone number and role (e.g. investor, broker, owner). In the course of using the platform, we also process profile data, search profiles, property and offer data, enquiries, messages, uploaded documents and NDA signatures. This data is required to provide you with access to the closed platform and its functions. The legal basis is the performance of a contract or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR).

For database, authentication and file storage, we use Supabase Inc., 970 Toa Payoh North #07-04, Singapore, as a processor; a data processing agreement pursuant to Art. 28 GDPR is in place with Supabase. The data is stored within the European Union (Ireland region, eu-west-1).

To send system and notification emails (e.g. registration confirmations, property and matching notifications, status updates), we use Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor. The recipient address, name and the content of the respective notification are processed. Resend uses Amazon Web Services (Amazon SES) as a sub-processor for delivery. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in informing our users (Art. 6(1)(f) GDPR). A data processing agreement is in place with Resend; transfers to the USA are safeguarded by EU standard contractual clauses.

For certain functions we use AI models from Anthropic PBC, 500 Howard St, San Francisco, CA 94105, USA. Only the inputs required for the respective function are transmitted to the Anthropic API:

• Quick check and property valuation: the property data you enter (e.g. location, purchase price, rents, year of construction);
• Exposé import: contents of uploaded exposés for automatic data extraction;
• Financing enquiries: contents of uploaded financing documents for preparation and summarisation;
• Surveys: free-text answers for evaluation.

We recommend not entering any unnecessary personal data in free-text fields and uploads. The results are provided solely for your information; no automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in efficient platform functions (Art. 6(1)(f) GDPR). Anthropic processes the data as a processor on the basis of the Anthropic Commercial Terms, including the data processing addendum, and does not use API inputs to train its models. Transfers to the USA are safeguarded by the EU-US Data Privacy Framework or EU standard contractual clauses.

To manage contacts and enquiries, we use the real estate software onOffice (onOffice GmbH, Charlottenburger Allee 5, 52068 Aachen, Germany). Contact data (name, email address, telephone number, company) and platform-related activities (e.g. property views, enquiries) are transmitted to onOffice and assigned to the respective contact there. onOffice processes the data as a processor in Germany. The legal basis is our legitimate interest in efficient client and enquiry management (Art. 6(1)(f) GDPR).

For internal notifications to our team (e.g. for new enquiries, partner applications or messages), we use Slack (Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland). Name, company and a short preview of the enquiry or message may be transmitted. The legal basis is our legitimate interest in handling enquiries quickly internally (Art. 6(1)(f) GDPR). Processing in the USA (Salesforce, Inc.) is possible; Salesforce is certified under the EU-US Data Privacy Framework, and EU standard contractual clauses are also in place.

For interactive maps, we use the open-source library MapLibre GL with map tiles and fonts from OpenFreeMap (getipfy OG, Austria; based on OpenStreetMap data). When a map is loaded, your IP address is necessarily transmitted to OpenFreeMap’s servers for technical reasons. No cookies are set and no tracking takes place. The legal basis is our legitimate interest in clearly presenting property locations (Art. 6(1)(f) GDPR).

On certain pages we embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode (youtube-nocookie.com). In this mode, YouTube only sets cookies and collects usage data once you actively play the video. When you play it, data (including your IP address) may be transmitted to Google, including to the USA. The legal basis is our legitimate interest in providing video content (Art. 6(1)(f) GDPR); playback takes place at your instigation. Further information: policies.google.com/privacy.

If you subscribe to our newsletter, we process your email address for the purpose of sending it. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw this at any time with effect for the future – via the unsubscribe link in every email, the unsubscribe page or the email settings in your account (email_preferences). Registered users can opt in and out of individual notification types (e.g. deal alerts, digest) separately. For surveys we use personalised, tokenised links; participation is voluntary, and the legal basis is your consent or our legitimate interest in improving the platform (Art. 6(1)(a) and (f) GDPR).

If you contact us via the contact form, by email or by telephone, we process the data you provide in order to handle your enquiry. The legal basis is the performance or initiation of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in responding (Art. 6(1)(f) GDPR).

We only use technically necessary cookies and storage entries:

• Supabase authentication cookies (“sb-…-auth-token”): maintain your login session; stored for the duration of the session’s validity.
• Local storage entries (localStorage) for interface settings (e.g. language) and a cached copy of your chat overview for faster loading, which is deleted when you sign out.

We do not use tracking, marketing or analytics cookies. As only technically necessary cookies are used (Section 25(2) TDDDG), no consent via a cookie banner is required.

If you allow notifications, you receive alerts about new messages, matching properties or approvals, for example. For this we store a device-specific identifier (push subscription or device token) together with your user account. Delivery takes place via the push service of your operating system or browser:

• Offmarketpool app for iPhone and iPad, and Safari: Apple Push Notification service (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland; Apple Inc., Cupertino, USA).
• Offmarketpool app for Android, and Chrome: Firebase Cloud Messaging (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA).
• Other browsers: the push service of the respective browser vendor.

The device identifier and the title and short text of the notification are transmitted. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time in your device or browser settings. Processing in the USA is possible; Apple and Google are certified under the EU-US Data Privacy Framework.

The Offmarketpool app for iOS and Android displays the content of offmarketpool.de; the other sections of this policy apply. The app only accesses the camera, photos and microphone (e.g. for images or voice messages in the chat) when you use the respective function and have granted permission in the operating system. You can delete your account yourself in the app and on the website under Profile → Delete account.

Offmarketpool is a closed brokerage platform. Within the platform’s functions, data is only shared between users for specific purposes (e.g. an interested party’s contact details to the offering broker after signing an NDA, forwarding of financing enquiries to licensed financing partners). Where they need it for approval or as information about the marketing, we tell the owners or sellers of a property the name and company of interested parties to whom we have offered their property or who have requested an exposé or data room access (for private individuals, only a shortened surname before an enquiry) – never the email address or telephone number. The legal basis is the performance of the brokerage (Art. 6(1)(b) GDPR) or our legitimate interest in transparent marketing (Art. 6(1)(f) GDPR). Your data is not sold to third parties.

We store personal data only for as long as is necessary for the stated purposes or as required by statutory retention obligations (in particular under commercial and tax law, 6 or 10 years). Account data is deleted when the account is deleted, unless retention obligations prevent this. Server log files are automatically deleted by the host after a short period.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent you have given at any time with effect for the future. To do so, please contact: marcel@dr-hofeditz.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, datenschutz-hamburg.de.

Providing your data is neither a statutory nor a contractual requirement; however, without the data collected during registration we cannot grant you access to the platform. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

We use technical and organisational measures to protect your data, in particular TLS encryption, role-based access controls (Row Level Security) and regular security reviews.