Skip to content
Eigentum
v918 October 2026

Privacy Policy

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ilya Baskakov
(operating as: Eigentum²)
Von-Müller-Straße 15a
82467 Garmisch-Partenkirchen, Germany

Email: support@dein-eigentum.de
Phone: +49 176 26554582

For questions about data protection and to exercise your rights, contact us at support@dein-eigentum.de. We have not appointed a data protection officer because we are not required to.

The recipients we name are listed in the "Recipients and Subprocessors" register (https://dein-eigentum.de/legal/subprocessors). That register forms part of this privacy policy. Details of our AI features are in the AI Transparency Notice (https://dein-eigentum.de/legal/ai-transparency); details of cookies and similar technologies are in the Cookie Policy (https://dein-eigentum.de/legal/cookies).

2. Scope, roles and deletion

This privacy policy covers processing for which we are the controller: when you visit our website, use the platform or contact us. Where you manage third-party data in the platform (for example tenants or borrowers), we process it as your processor under the Data Processing Agreement, and you are the controller.

When you delete a record, it becomes unusable immediately and is permanently deleted after 90 days, unless a statutory retention duty, a longer period under this privacy policy or a hold applies. We place such a hold on an organisation only where a legal obligation requires its data to be kept (Art. 6(1)(c), Art. 17(3)(b) GDPR). Once the hold is lifted, deletion follows as soon as the relevant period has expired.

3. Purposes, legal bases and storage periods

For each purpose we state the data, the legal basis, the recipients, any transfer to a third country and the storage period. We name recipients here by category; the individual bodies are listed in the "Recipients and Subprocessors" register. Section 5 describes the safeguards for transfers to third countries. Our hosting and database providers store the data in the EU (Frankfurt); they have their seat in the USA, and the safeguards under section 5 also apply to any access from there. Under "Third country" we list, for each purpose, the other recipients outside the European Economic Area.

3.1 Account, sign-in and account security

We set up your account, sign you in and protect your account against unauthorised access.

  • Data: Name, email address, password hash, optional profile details such as phone number and profile picture, settings such as language and currency, two-factor sign-in data, sessions (IP address, browser identifier, times) and suspension notes (the fact, reason and end of a suspension for breach of the Terms of Service). If you sign in with Google, we receive from Google your name, your email address, your profile picture, whether your email address is verified, and the access keys Google issues for the sign-in, which we do not store; we store the profile picture once in our own file storage.
  • Legal basis: Art. 6(1)(b) GDPR (user contract). For sessions and suspension notes, Art. 6(1)(f) GDPR, our and your interest in the security of your account and of the platform.
  • Recipients: hosting and database providers, email service provider, and, when you sign in with Google, Google's sign-in service (register).
  • Third country: USA (email service provider, Google's sign-in service).
  • Storage period: Account data for the term of the user contract and for 90 days after the account is deleted. Longer only while you are still the owner of an existing organisation or while a hold applies. Sessions until no later than 24 hours after they expire.

3.2 Providing the platform

We provide the platform's features: properties, tenancies, finances and loans, documents, sharing, organisations with their members, and ownership transfers.

  • Data: The content you or members of your organisation enter or upload, in particular property data with address and coordinates, tenancy, financial and loan data, documents and images. Organisation, members, roles and invitations. Shares (the recipient's email address, message, expiry date, time of first access). Ownership transfer data (participants, invitations, documents, event history) and the change history of loans.
  • Address and location: While you type an address, our servers send the text entered to a map service to obtain address suggestions. Our servers determine a property's district through a second map service from its coordinates alone. On a share page, a map loads only after the viewer clicks; the map service then receives the property's coordinates and that person's IP address and browser data.
  • Special categories: We do not deliberately collect data within the meaning of Art. 9(1) GDPR. Such data may be contained incidentally in free text or uploaded documents, for example in documents relating to a transfer on death; to that extent we rely on Art. 9(2)(a) or (f) GDPR.
  • Legal basis: Art. 6(1)(b) GDPR; this also covers determining the district for a valuation. Art. 6(1)(f) GDPR for determining the district when you select an address and for the map on share pages, our interest in complete location data and in a shared property showing where it is; you may object to this processing (section 6). Also Art. 6(1)(f) GDPR for the change history of loans and the event history of transfers, the interest of everyone involved in being able to trace who changed what and when.
  • Recipients: hosting, database and file storage providers as processors; map services as independent controllers; the people you share content with or invite to your organisation or to an ownership transfer, within the permissions you set (register). You decide whom you share content with or invite and which permissions you set, and you are responsible for that choice.
  • Third country: USA (file storage, map service for address suggestions and maps); United Kingdom (map service for the district).
  • Storage period: Content until you delete it, then 90 days (section 2). Deleted loans with a change history and deleted properties with such a history or an ownership transfer until the organisation is deleted, and thereafter like the organisation. Data of an ownership transfer in which another organisation takes part, with its event history and documents, the transferred property without its other content, and only the name of the selling organisation, until that other organisation is permanently deleted; ownership transfers still in progress are ended 90 days after the organisation's deletion. A deleted record that a record still stored refers to, for example a contact that a lease refers to, is permanently erased only together with that record. Shares until they expire or are revoked, at the latest until the property or the account is permanently deleted. Organisation invitations that are not accepted until they expire; accepted ones until the organisation is permanently deleted.

3.3 AI features

We offer an AI-assisted property valuation and the reading of loan and financing documents. Both run only when you initiate them.

  • Data: For a valuation, the stored property record including the full address and coordinates, and photographs of the property, reduced in size and without metadata. The AI Transparency Notice states which data is not transmitted. For document reading, the documents you select, in full and unaltered. The AI providers receive no other content from the platform.
  • Legal basis: Art. 6(1)(b) GDPR.
  • Recipients: AI providers as processors; the search terms of the market research reach a search service through an AI provider (register).
  • Third country: USA (AI providers).
  • Storage period: We store a valuation result with its data basis on the property and delete it with the property. We do not store the result of document reading; the values are entered into the loan form, where you check them. How long the AI providers store data is stated in the AI Transparency Notice.

The results are estimates; no automated decision within the meaning of Art. 22 GDPR is made. For details, including that the AI providers do not use your data for training, see the AI Transparency Notice.

3.4 Billing and statutory retention

We bill your subscription and meet our retention duties under tax and commercial law.

  • Data: Billing address, tax number or VAT identification number, subscription and invoice data, payment data (for cards only the brand, last four digits and expiry date), changes to the tax number with the time, IP address and browser identifier, and any credit balance still held when we delete your customer record at the payment service provider, together with its payout.
  • Legal basis: Art. 6(1)(b) GDPR; for retention and for recording changes to the tax number, Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB; for retaining a credit balance and its payout, Art. 6(1)(c) GDPR in conjunction with § 147 AO.
  • Recipients: payment service provider, for the payment form a font service, hosting and database providers, email service provider (register).
  • Third country: USA (payment service provider, font service, email service provider).
  • Storage period: Books and annual accounts 10 years, accounting vouchers 8 years, commercial and business letters 6 years, each from the end of the calendar year in which they arose. We keep our records of invoices and refunds, independently of the organisation's deletion, until ten years after the end of the calendar year in which they arose; the invoices also remain stored at the payment service provider. We keep the billing evidence in our database (declarations made at checkout, changes to the tax number, payment events) while the organisation exists and thereafter until ten years after it was recorded. A credit balance that has been paid out, together with its payout, until ten years after the end of the calendar year of the payout; a credit balance that has not been paid out until ten years after the end of the calendar year in which it was recorded. Payment method data, including the data stored on our behalf at the payment service provider, until 90 days after the organisation is deleted.

3.5 Service messages

We inform you in the platform and by email about events in your account and remind you of dates and deadlines arising from your data. Service messages contain no advertising. We currently send no advertising emails; if we introduce them, we will obtain your consent beforehand, which you can withdraw through an unsubscribe link in every message.

  • Data: Type and occasion of the message, the related record, the message text, delivery and read status; for billing emails sent and for other messages whose receipt we need to be able to prove, a dispatch record (recipient, subject, content of the message, time, delivery status). For addresses that our email service provider reports as permanently undeliverable or as no longer accepting our emails, for example after a spam complaint, an entry in a suppression list (email address, reason, time).
  • Legal basis: Art. 6(1)(b) GDPR. For dispatch records also Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB where they evidence commercial or business letters, and Art. 6(1)(f) GDPR, our interest in being able to prove that messages were received. For the suppression list Art. 6(1)(f) GDPR, our interest and that of the address holder in not sending further emails to such an address, and our interest in keeping our emails deliverable to all other recipients.
  • Recipients: email service provider, hosting and database providers (register).
  • Third country: USA (email service provider).
  • Storage period: Messages in the platform 12 months after they are read, unread ones 24 months after they are created, longer only while a hold applies. Dispatch records while the related organisation exists, thereafter until six years after the end of the calendar year of dispatch. Suppression list entries, including the corresponding entries at our email service provider, as long as we store account data for that address (section 3.1); for an address that does not belong to a user account, we delete our own entry without undue delay, and the entry at our email service provider remains until the address holder requests its erasure.

3.6 Enquiries to us

We answer enquiries you send us through our contact form or by email.

  • Data: Name, email address, optionally phone number and company, the occasion and content of your enquiry.
  • Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns or prepares a contract with us. Otherwise, for the contact form, the consent you give in the form (Art. 6(1)(a) GDPR), and for emails Art. 6(1)(f) GDPR, our interest in answering enquiries.
  • Recipients: email service provider, provider of our mailbox (register).
  • Third country: USA (email service provider, provider of our mailbox).
  • Storage period: Until your enquiry has been dealt with in full. If it concerns a contract, we keep it as a commercial or business letter for 6 years from the end of the calendar year (§ 257 HGB, § 147 AO).

3.7 Evidence of acceptances and consents

We keep evidence that and how you accepted contract documents, made declarations at checkout and decided on cookies.

  • Data: Acceptance of contract documents such as the Terms of Service (version, time, IP address, browser identifier). Declarations at checkout, for example consent to the service starting immediately or the statement that you order as a business (content of the declaration, name, time, version, IP address, browser identifier). Cookie decisions (categories chosen, time, version of the Cookie Policy and of the banner, language, a pseudonymous consent identifier, truncated IP address, browser identifier and, if you were signed in, the link to your account).
  • Legal basis: For acceptances and declarations at checkout, Art. 6(1)(b) GDPR because they are part of concluding the contract, and Art. 6(1)(f) GDPR, our interest in being able to prove the conclusion of the contract. For cookie decisions, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) and Art. 5(2) GDPR; we record a refusal in the same way as a consent.
  • Recipients: hosting and database providers (register).
  • Third country: no other recipients.
  • Storage period: Acceptances for the life of your account; they are deleted with it. Declarations at checkout as for the billing evidence (section 3.4); we delete the IP address and browser identifier after 180 days. Cookie decisions: truncated IP address and browser identifier after 12 months, the whole record after 3 years.

3.8 Cancellation and withdrawal declarations

Through our online cancellation function (§ 312k BGB) we receive your declaration without sign-in, and through our online withdrawal function (§ 356a BGB) in your customer account; we confirm receipt and carry out the declaration.

  • Data: What you enter in the form (name and email address; a contract or invoice reference; for a cancellation, its type, any reason given and the requested date), time of receipt, IP address, browser identifier, language, and the result of matching it to a contract together with the steps taken as a result.
  • Legal basis: Art. 6(1)(c) GDPR in conjunction with §§ 312k and 356a BGB for carrying out the declaration and confirming its receipt. Art. 6(1)(f) GDPR for informing the account holder, recording the IP address and browser identifier and keeping the record as evidence, our interest and the account holder's interest in protecting the contract against declarations by third parties and in being able to establish, exercise or defend legal claims, and to limit receipt confirmations to the same email address that belongs to no customer account to three per 24 hours; for this we keep a pseudonymised check value of the address for 24 hours.
  • Recipients: hosting and database providers, email service provider (register); the holder of the account concerned.
  • Third country: USA (email service provider).
  • Storage period: Until 31 December of the third year after the year of receipt; longer only while a hold applies.

3.9 Statistics and advertising (only with consent)

With your consent to statistics cookies, we use Google Analytics to analyse the use of our public pages and of checkout and to see which advertising campaigns lead to sign-ups and purchases. With your consent to marketing cookies, we measure and target our advertising on Facebook and Instagram with the Meta Pixel and the Meta Conversions API. The scripts of both providers load only on our public pages and at checkout. From the signed-in application we send only to Meta, and only with your consent, events for purchases and capacity requests in billing, from our server. Neither Google nor Meta receives content you store in the platform.

  • Data: For Google Analytics, pseudonymous browser and session identifiers, the address and title of the page viewed, the domain of the page you came from, browser language, events on the public pages and at checkout (for a purchase the amount, plan and subscription identifier), and IP address and browser data. For the Meta Pixel and the Conversions API, browser and click identifiers, the address of the page viewed and of the page you came from, IP address and browser data, events on the public pages and at checkout, the billing events named above, and hashed contact data (email address, first and last name, phone number, user ID) for matching with user accounts at Meta.
  • Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
  • Recipients: Google Ireland Limited as our processor; Google Signals, the advertising features and data sharing with Google are switched off. Meta Platforms Ireland Limited as joint controller with us for collecting and transmitting the data (Art. 26 GDPR) and as our processor for measuring our campaigns and matching the contact data (register).
  • Third country: USA (Google LLC, Meta Platforms, Inc.).
  • Storage period: We do not store this data beyond transmitting it, except for a note that a purchase was reported to Meta, which is kept for 7 days so that it is not reported twice. At Google, event-level and user-level data is deleted after 2 months. At Meta, the contact data transmitted for matching is deleted after matching, and event data is stored for at most two years; Meta's data policy governs Meta's processing for its own purposes. The storage period on your device is stated in the Cookie Policy.

Google Analytics combines your visits into a usage profile by means of the pseudonymous browser identifier, which we analyse for statistics only; it is not linked to any user account. Meta may use the data under its own responsibility to build advertising profiles and to deliver advertising.

Joint controllership with Meta. We have concluded an arrangement under Art. 26 GDPR with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (https://www.facebook.com/legal/controller_addendum). Under it, we inform you about the joint processing and integrate the Pixel correctly. Meta is responsible for the security of its products and for handling requests under Art. 15 to 20 GDPR concerning the data stored by Meta. You may exercise your rights against us and against Meta (Art. 26(3) GDPR); we forward requests concerning Meta to Meta. Any further processing by Meta for its own purposes is Meta's sole responsibility; Meta provides information on it at https://www.facebook.com/privacy/policy.

3.10 Operations, security and abuse prevention

We keep the platform secure and stable, defend against attacks and make access to borrower data and significant administrative actions traceable.

  • Data: Server logs (IP address, time, request, status code, browser identifier, error messages). To protect against abuse we count requests per IP address and per (pseudonymised) email address. A log of access to borrower data and of significant administrative actions on accounts and organisations, for example the handover of an organisation's ownership or actions by our support (acting person, time, record concerned, and for access the IP address and browser identifier).
  • Legal basis: Art. 6(1)(f) GDPR, our and your interest in the security and stability of the platform, in defending against attacks and in the traceability of access and administrative actions; for access to borrower data also the borrowers' interest in it.
  • Recipients: hosting and database providers (register).
  • Third country: no other recipients.
  • Storage period: Server logs at most 30 days. The counters at the latest two days after the last request. Log entries about access and entries containing an IP address or browser identifier 12 months, other log entries until 31 December of the third year after the entry, entries about access and about the handover of ownership relating to a deleted organisation at most until 90 days after its deletion; in each case longer only while a hold applies.

4. Sources of data

We collect most data from you. We receive from third parties:

  • from Google, the data named in section 3.1 when you sign in with Google;
  • from other users, your email address and, where applicable, your name when they invite you to an organisation, a share or an ownership transfer;
  • from our email service provider, the report that an address is permanently undeliverable or no longer accepts our emails (section 3.5);
  • from our payment service provider, the payment status and the payment method data under section 3.4.

5. Other recipients and transfers to third countries

We do not sell your personal data. We disclose data to authorities where we are legally obliged to or where this is necessary to establish, exercise or defend legal claims (Art. 6(1)(c) or (f) GDPR). If our business is sold or restructured, data may pass to the acquirer (Art. 6(1)(f) GDPR, our interest in the sale or restructuring and in the acquirer continuing the service); we will inform you in advance.

We base transfers to the USA on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise and in the alternative on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). For the United Kingdom there is an adequacy decision of the European Commission (Art. 45 GDPR). The "Recipients and Subprocessors" register states which safeguard applies to which recipient. You can obtain a copy of the safeguards on request at support@dein-eigentum.de.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Contact us at support@dein-eigentum.de. On request we provide a full export of your data within one month in a structured, commonly used and machine-readable format, and in any case before your account record is deleted. We respond within one month; for complex requests the period may be extended by two months, and we will tell you in advance. To protect your data, we may ask you to confirm your identity. We aim to resolve complaints about the processing of your data within 30 days.

Withdrawal of consent (Art. 7(3) GDPR). You may withdraw a consent at any time with effect for the future; the lawfulness of processing up to the withdrawal is not affected. You withdraw consent to statistics and marketing cookies through the "Cookie settings" link in the footer of our website; the withdrawal takes effect immediately. You can also adjust Meta's advertising processing in your ad preferences at Meta (https://www.facebook.com/adpreferences). You withdraw a consent given in the contact form by emailing us.

Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Where your data is processed for direct marketing, you may object to this at any time; the data will then no longer be processed for that purpose.

Right to lodge a complaint (Art. 77 GDPR). You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de
poststelle@lda.bayern.de

7. Further information

Security. We protect your data with technical and organisational measures under Art. 32 GDPR; they are described in the document "Technical and Organisational Measures" (https://dein-eigentum.de/legal/toms).

Automated decisions. We make no decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

Requirement to provide data. There is no statutory obligation to provide us with data. To conclude the user contract we need your name, your email address and a password or sign-in with Google, and for a paid plan also billing and payment data. Without these details we cannot set up an account or conclude a paid plan. All other details are voluntary; if they are missing, individual features are not available.

Minors. The platform is intended for adults. If we find that we have inadvertently collected data of a child under 16, we promptly take steps to delete it.

Third-party offerings. Websites and services of third parties that we refer to are governed by their own privacy policies; we are not responsible for processing by those providers.

8. Changes

The effective date shows the version of this privacy policy. If we change purposes, categories of recipients, third-country transfers or how you exercise your rights, we inform you in advance in a suitable way, for example by email or in the platform, and provide a summary of the changes in every supported language. We will send you earlier versions on request.