Privacy policy

Lutz Haase

Stephanie Gerda Haase

Glasbläserallee 15A

10245 Berlin

Germany

Email: lutz.haase@ftwk.io

Lutz Haase and Stephanie Gerda Haase jointly determine the purposes and means of processing on this website and are therefore joint controllers under Article 26 GDPR. Privacy requests may be sent to the email address above or to either controller individually. Data subjects may exercise their rights against either controller regardless of this allocation of responsibilities.

We process personal data only where necessary to operate the website securely, handle property enquiries, prepare a possible property sale or measure website reach with your permission. We do not use automated decision-making. In particular, data-room activity does not automatically produce buyer scores, rankings, priority changes or access decisions.

When you enquire, we process your name, email address, phone or WhatsApp number, any optional message, selected website language and technical source information such as the page visited, referrer and any UTM campaign parameters. The information is stored in a protected enquiry database on our server and sent as a notification to the project mailbox.

Processing is necessary to respond to your enquiry and take pre-contractual steps at your request under Article 6(1)(b) GDPR. Where required for orderly handling, preventing abusive submissions or documenting communications, processing also relies on our legitimate interests under Article 6(1)(f) GDPR. We do not use these details for newsletters or unsolicited marketing.

For approved prospective buyers, we process name, email address, language, account status and expiry date. To provide documents securely and accountably, we record personal invitation-link openings, access activation, data-room visits, successful and failed logins, document downloads and timestamps. A new visit starts after 30 minutes of inactivity. Usage analytics contain no IP or device identifier. Technical identifiers are pseudonymised with a server-side secret only for short-term abuse prevention. We do not measure reading time or whether a document has been read in full. Passwords are stored only as cryptographic hashes. Each account is personal, time-limited and may be revoked at any time.

The internal sales cockpit may record handling status, priority, owner, next actions and private call notes. Processing supports pre-contractual steps at your request under Article 6(1)(b) GDPR and our legitimate interest in a secure, orderly and accountable sale process under Article 6(1)(f) GDPR. Activity counters are not used for automatic assessment or prioritisation. Detailed usage events and visits are erased after 180 days, failed-login and session-security data after seven days, and invalid invitations no later than 30 days after expiry.

The website is hosted on a server operated by Hetzner Online GmbH in Germany. When a page is requested, technically necessary log data may be processed, including IP address, date and time, requested URL, data volume, referrer, browser and operating system. This is required to deliver the website, diagnose errors and prevent attacks. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in secure and reliable operation.

We use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics is activated only after you have expressly consented. Usage data such as pages visited, approximate region, device and browser information, interactions and a pseudonymous identifier may then be processed. Advertising signals and personalisation are disabled, and IP anonymisation is enabled.

The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. You can change your choice at any time with effect for the future. Withdrawal does not affect processing carried out lawfully before withdrawal.

Enquiries are generally accessible only to the two controllers. We use carefully selected providers for operation and communication: Hetzner Online GmbH for hosting and server security, united-domains GmbH for authenticated email transport, and Google Ireland Limited for the professional recipient mailbox and - only after consent - Google Analytics. Technical advisers receive access only where necessary for troubleshooting and subject to confidentiality. Messages are not forwarded to Posteo.

The website and enquiry database are operated in Germany. When Google Analytics is enabled, processing by Google companies in the United States cannot be excluded. Google states that relevant transfers rely on applicable adequacy decisions, including the EU-US Data Privacy Framework, and supplementary Standard Contractual Clauses. No analytics data is sent to Google without analytics consent.

Enquiry data is retained only for as long as needed to handle the enquiry and a possible sale. If there is no further communication, it is normally deleted no later than twelve months after the last substantive contact. Detailed data-room activity and visits are erased after 180 days, failed-login and session-security data after seven days, and invalid invitations no later than 30 days after expiry. Records required for a specific security incident or legal duty may be kept longer. Where negotiations or a sale take place, relevant documents may be retained longer to meet statutory retention and limitation periods. Your analytics preference remains in your browser until you change it or clear local browser storage.

Name, email address, phone number and agreement to enquiry-related processing are required to use the contact form. Without them, we cannot reliably process the enquiry through the form. You may still contact us by email.

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests. Consent may be withdrawn at any time with effect for the future. Please direct requests to lutz.haase@ftwk.io.

You may lodge a complaint with a data protection authority. The authority responsible for the controllers is, in particular, the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany. You may also contact the authority in your place of habitual residence.

The website is transmitted over encrypted HTTPS connections. We use appropriate technical and organisational measures to protect data against loss, alteration and unauthorised access. This policy will be updated if website functions, providers or legal requirements change materially. The current version is permanently available through the footer.