1. Processing of personal data

a) User account

You have the option of creating a user account on the website. In this account you can, among other things, view the status of the purchase process, the contact details of your estate agent and appointments. Within the scope of registration, Ziegert EverEstate GmbH processes the following personal data: Salutation, first and last name, e-mail address, telephone number. After registration you will receive an e-mail from Ziegert EverEstate GmbH with a link to confirm your registration. If you click on the confirmation link, you will subsequently be asked to set a password for your user account. The legal basis for the data processing is Art. 6 para. 1 p. 1 lit. b GDPR. The data will be stored until you deactivate your user account. Legal storage obligations remain unaffected. Your personal data will also be made available to the broker in respect of whose offer you have made an enquiry. The purpose of the data transfer is that you can contact the broker directly and that the broker can inform you of the status of the process via the account. The legal basis for the data transfer is Art. 6 para. 1 p. 1 lit. b GDPR.

b) Contact option

You have the option of contacting Ziegert EverEstate GmbH via the website (e.g. by e-mail, via the contact form). If you submit an enquiry or request the transmission of one of our brochures (e.g. Investor's Guide), Ziegert EverEstate GmbH processes your personal data (depending on the enquiry, title, first and last name, e-mail address, telephone number, content of the message) in order to respond to your enquiry. If the processing of your enquiry relates to services or offers of other companies of the Ziegert Group or requires the involvement of these companies, we will pass on your personal data to Ziegert Bank- und Finanzierungsconsulting GmbH, Zimmerstraße 16, 10969 Berlin, so that the company can contact you directly. The legal basis for the data processing is Art. 6 para. 1 p. 1 lit. b GDPR. The collected data will be stored for as long as is necessary to process the request and then deleted, unless further data storage is required or justified by law.

Furthermore, you have the option to book an appointment for a personal meeting with one of our sales representatives via the website. The booking is done through our service provider Calendly LLC, 88 North Avondale Road Suite 603, Avondale Estates, GA 30002, United States ("Calendly"). The booking process works as follows: you may submit a request on our website and have to answer some qualification questions, e.g. how many rooms the property you wish to purchase should have, what your maximum affordable price is or whether you have organised financing or not. We will process your name, email address, phone number, the content of your request and the answers to the questions. You will then be redirected to the Calendly site. Here you can select a date and time to book an appointment with one of our sales staff.

The legal basis for the data processing is Art. 6 para. 1 p. 1 lit. b GDPR. The transfer of data to Calendly, including the transfer to the U.S., is secured via the standard contractual clauses. The collected data will be stored as long as necessary for the organization and execution of the appointment and then deleted, unless further data storage is required or justified by law.

c) Cooperation with other companies of the Ziegert Group

Depending on the assignment, it may be necessary for us to involve other Ziegert companies in the course of initiating or executing the contract, e.g. if you seek advice from us on a property or service (e.g. financing). This enables us to tailor the offer to your needs in the best possible way. This cooperation enables us to put together suitable property offers and services for you from the diverse Ziegert range. For this purpose we exchange your personal data, i.e. name and e-mail address with other Ziegert companies:

ZIEGERT Bank- und Finanzierungsconsulting GmbH, Zimmerstraße 16, 10969 Berlin, for advice on financing options for the purchase of a property. The legal basis is Art. 6 para. 1 p. 1 lit. b GDPR, insofar as the exchange of data is necessary for the performance of the contract or the provision of pre-contractual measures at your request. In addition, we occasionally exchange personal data in order to offer you the opportunity to be informed about all services and offers of all Ziegert companies so that you can benefit in the best possible way from the close cooperation and the provision of services "from a single source". This procedure also corresponds to our legitimate interests of a full service offer. In this case, the legal basis is Art. 6 para. 1 p. 1 lit. f GDPR. The data collected will be stored for as long as is necessary for the contractual relationship or you do not object to receiving the information. Subsequently, the data will be deleted unless further data storage is required or justified by law.

d) Notifications

On our website we offer the possibility for you to save your criteria for searching for a property and to receive a notification by e-mail as soon as new properties matching the search criteria are available. For this purpose, Ziegert EverEstate GmbH processes your title, first and last name, e-mail address and the search criteria you have selected (e.g. location of the property, budget, number of rooms, area, other features). Before sending the notification, you must expressly confirm to us within the framework of the so-called double opt-in procedure that we should activate the notification service for you. For this purpose, you will receive a confirmation and authorisation e-mail from us, with which we ask you to click on the link contained in this e-mail and thereby confirm to us that you would like to receive the notifications. The legal basis is Art. 6 para. 1 p. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future, e.g. via the following e-mail address: contact@everestate.de. The collected data will be stored as long as you do not object to receiving the notifications. Subsequently, the data will be deleted unless further data storage is required or justified by law.

2. Processing of personal data during informative use

In the case of merely informational use of the website, i.e. if you do not log in to use the website, register, use the contact form or otherwise transmit information to us, we do not collect any personal data, with the exception of the data that your browser transmits to enable you to visit the website (for example, IP address, date and time of the request, browser type and pages viewed). No personal exploitation takes place, except in the cases described in this privacy policy. The statistical evaluation of anonymised data records is reserved. The legal basis for the processing of personal data is Art. 6 para. 1 p. 1 lit. b GDPR, insofar as the data processing is necessary for the provision of our offer. Data processing beyond this is based on Art. 6 para. 1 p. 1 lit. f GDPR. We have a legitimate interest in ensuring the security and effective use of our website. The automatically collected personal data is stored within the scope of the statutory retention periods and then deleted immediately.

3. Cookies and similar technologies

The internet pages use so-called cookies and similar technologies in several places (unless expressly designated otherwise, these technologies are hereinafter collectively referred to as "cookies"). They serve to make our offer more user-friendly and effective. Cookies are small text files that are stored on your computer and saved by your browser. They allow us to recognize the device you are using. Most of the cookies we use are so-called "session cookies", which we set for a limited period of time during your visit to our website. For certain offers we use persistent cookies, which are used to recognise visitors and are stored on your computer for future sessions. Persistent cookies are automatically deleted after a set period of time, which may vary depending on the cookie.

Cookies can be "first party cookies", i.e. cookies set by Ziegert Everestate GmbH, or "third party cookies", i.e. cookies set by third parties. We work in strict compliance with legal requirements with respective external companies that provide services such as web tracking or reach measurement for us. We have ensured that these companies comply with the requirements of this privacy policy. Additional individual information on cookies and data protection with regard to the individual services can be found in the following sections. Cookies do not cause any damage to your computer and do not contain viruses. In your browser settings, you can determine whether cookies may be set or not.

a) Necessary cookies

Cookies that are necessary to carry out the electronic communication process or to provide certain functions or our website to you as well to operate our website (so-called necessary cookies) are stored on the basis of Art. 6 para. 1 p. 1 lit. b GDPR. They cannot be deactivated as the cookies are necessary to provide you with the relevant services. These are, for example, cookies with which your data protection settings are stored.

b) Non-essential cookies

All other non-essential cookies are only set if you have given your prior consent. The legal basis is Art. 6 para. 1 p. 1 lit. a GDPR. We use a cookie banner for this purpose, in the context of which you can give your consent to the various cookies. The consent is voluntary and can be revoked at any time without giving reasons with effect for the future by changing the cookies settings at https://www.everestate.com/cookies. You may also refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

aa) Statistics Cookies

We use statistics cookies to evaluate the use of our website. These cookies collect data about how visitors use our services in order to improve the performance of our services. If you do not allow these cookies, we will not be able to analyse the performance of our services and tailor them to the needs of our users. We currently use the following statistics cookies:

(1) Google Analytics

This website uses functions of the web analysis service Google Analytics of Google Inc. (Google), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (http://www.google.de/). The information generated by the cookie about your use of the website will generally contain personal data (e.g. your IP address, online and device identifiers, information about your user behavior) and be transmitted to and stored by Google on servers in the United States. In the event that IP anonymisation is activated on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will process this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Some of the cookies are session cookies. Others expire within 24 hours, 90 days or 1-2 years. The data collected with Google Analytics is deleted within 26 months.

The data processing is based on your consent, Art. 6 para. 1 p. 1 lit. a GDPR. The transfer of data to Google is based on Art. 28 GDPR in conjunction with the respective data processing agreement. We have concluded EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Google to secure the transfer of your personal data to third countries and will take additional security measures to the extent necessary to compensate for the lower level of data protection in the U.S. compared to the level of data protection in the EU. You can also prevent the collection of the data generated by the cookie and related to your use of the website (incl. your IP address) to Google as well as the processing of this data by Google by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de. You can also prevent the collection of data by Google Analytics by clicking on the following link: Deactivate Google Analytics. An opt-out cookie will be set to prevent future collection of your data when visiting this website. For more information on the terms of use and data protection of Google Analytics, please visit http://www.google.com/analytics/terms/de.html or https://www.google.de/intl/de/policies/.

(2) Mixpanel

This website uses functions of the web analysis service Mixpanel of Mixpanel, Inc., 405 Howard Street, 2nd Floor, San Francisco, CA 94105 (https://mixpanel.com/) ("Mixpanel"). On behalf of the operator of this website, Mixpanel will process your personal data (e.g. IP address, user behavior) for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The information collected is stored on a server in the USA. Mixpanel creates pseudonymous user profiles based on the collected data. The profiles thus created are not merged with personal data in such a way that identification of the user is made possible.

The data collected with Mixpanel is automatically deleted within one year. The data processing is based on Art. 6 para. 1 p. 1 lit. a GDPR. The data transfer to Mixpanel is based on Art. 28 GDPR in conjunction with the respective data processing agreement. For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded the EU Standard Contractual Clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Mixpanel and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g., the USA) compared to the level of data protection in the EU.

If you do not wish Mixpanel to process your data for web analysis purposes, you can also object to the processing at any time with effect for the future on the https://mixpanel.com/optout/ page. Please note that this will result in a cookie being set on your end device, which prevents Mixpanel from collecting data for web analysis purposes. The objection is valid until you delete the cookie.

(3) Hotjar

This website uses Hotjar, an analytics software provided by Hotjar Ltd ("Hotjar"), Level 2 St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe. Hotjar enables us to analyse user behaviour on our website in order to better understand the needs of our users and to optimise our website. To do this, Hotjar processes the following data on our behalf:

• Shortened IP address
• User interactions
• Mouse events (movement, position and clicks)
• Keystrokes
• Language settings
• Screen sizes
• Browser settings
• Time and date of the visit to the website

Hotjar sets a cookie that assigns you a unique user ID to recognize you when you revisit our website and that expires after 365 days. Hotjar also places session cookies to recognize you across pages on our site, to identify new users and/or changes in user attributes, and to collect information about your viewport (size and dimension). In addition, Hotjar places cookies that expire after 30 minutes to identify when you first visit a page on our website and to identify whether you are included in data collection based on our website's pageview limit.

The data processing is based on Art. 6 para. 1 p. 1 lit. a GDPR. The data transfer to Hotjar is based on Art. 28 GDPR in conjunction with the respective data processing agreement. Hotjar may process personal data outside the EU/EEA. For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded the EU Standard Contractual Clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Hotjar and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g., the USA) compared to the level of data protection in the EU.

If you do not wish to have your data processed by Hotjar, you can also object to the processing at any time with effect for the future on the page https://www.hotjar.com/legal/compliance/opt-out. Please note that this will result in a cookie being set on your end device, which prevents the collection of data for web analysis purposes by Hotjar. The objection is valid until you delete the cookie.

(4) Google Tag Manager

This website uses the Google Tag Manager from Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (http://www.google.de/). Google Tag Manager is a solution that allows marketers to manage website tags through one interface. The Google Tag Manager service itself (which implements the tags) is a cookie-less domain, but helps us to load and manage third-party website tags and connect this website to respective services, for the use of which you have provided your consent. The Google Tag Manager service triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If consent has not been given at the domain or cookie level, this setting will remain in place for all tracking tags implemented with Google Tag Manager.

The data processed for Google Tag Manager will be automatically deleted or anonymized after 14 days.

The data processing is based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. The data transfer to Google is based on Art. 28 GDPR in conjunction with the data processing agreement.

For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded the EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Google and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. in the USA) compared to the level of data protection in the EU.

bb) Marketing Cookies

We use marketing cookies to display advertisements that better match your interests. Furthermore, the cookies help us to evaluate the effectiveness of our advertisements. We currently use the following marketing cookies:

(1) Google Ads

In order to run online advertising campaigns and to measure and improve their success, we use the Google Ads service, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and as part of this, conversion tracking. The conversion tracking cookie is set when a user clicks on an ad placed by Google. It allows Google to recognize your Internet browser and records, for example, a unique cookie ID, the number of ad views per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (ads with which the user no longer wishes to be addressed). These cookies lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, we and Google can recognise that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies can therefore not be tracked across Ads customers' websites. The information obtained using the conversion cookie is used to create conversion statistics for Ads customers who have opted in to conversion tracking. We learn the total number of users who clicked on our ad and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information that personally identifies users.

We only use Google Ads if you give your consent, Art. 6 para. 1 p. 1 lit. a GDPR. Google acts as a data controller for Google Ads and may process your personal data for other purposes. We have no influence on the data or the scope of data collection by Google. We also have no knowledge of the content of the data transmitted to Google. Details on data processing by Google can be found at: https://policies.google.com/privacy.

For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded the EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Google and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. in the USA) compared to the level of data protection in the EU.

Users who do not wish to participate in tracking can also easily deactivate the Google conversion tracking cookie via their internet browser under user settings by setting your browser to block cookies from the following domain: googleadservices.com. Alternatively, you can disable interest-based advertising at http://www.google.de/ads/preferences or disable general cookies at http://www.google.com/settings/ads/plugin. These users will not be included in the conversion tracking statistics. You can find more information about data protection in the context of Google Ads at this link: https://www.google.com/policies/technologies/ads/.

(2) Google AdSense

This website uses the online advertising service Google AdSense, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This is intended to present you with advertisements tailored to your interests. These advertisements are recognisable by the reference "Google ads" in the respective advertisement. When you visit our website, Google receives the information that you have accessed our website. Google sets a cookie on your computer for this purpose. The data mentioned under point 2 of this privacy policy are transmitted. In addition, so-called web beacons are used, which are invisible graphics that are used to evaluate your user behaviour on this website. The IP address transmitted by your browser as part of Google AdSense will not be merged with other Google data. We have no influence on the data collected, nor are we aware of the full extent of the data collection. This data is transferred to the USA and evaluated there. It is possible that this data will be passed on to contractual partners of Google and to authorities.

This website does not place any third-party ads via Google AdSense. The data collected with Google AdSense is automatically deleted after 90 days.

We only use Google AdSense if you give your consent, Art. 6 para. 1 p. 1 lit. a GDPR. Google acts as a data controller for Google Ads and may process your personal data for other purposes. We have no influence on the data or the scope of data collection by Google. We also have no knowledge of the content of the data transmitted to Google. Details on data processing by Google can be found at: https://policies.google.com/privacy.

For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded the EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Google and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. in the USA) compared to the level of data protection in the EU.

You can also prevent the installation of cookies from Google AdSense in other ways: By adjusting your browser software accordingly; in particular, the suppression of third-party cookies will result in you not receiving ads from third-party providers. By deactivating Google's interest-based ads via the link http://www.google.de/ads/preferences, whereby this setting will be deleted when you delete your cookies. By opting out of interest-based ads from the providers that are part of the self-regulatory campaign "About Ads" via the link http://www.aboutads.info/choices, this setting will be deleted when you delete your cookies. By permanently deactivating them in your Firefox, Internetexplorer or Google Chrome browsers at the link http://www.google.com/settings/ads/plugin. However, we would like to point out that in this case you may not be able to use all functions of this offer to their full extent. You can find the Google data protection conditions for advertising here: https://www.google.de/intl/de/policies/technologies/ads.

(3) DoubleClick

This website uses the online marketing tool DoubleClick provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (http://www.google.de/). DoubleClick uses cookies to serve ads that are relevant to users, to improve campaign performance reports, or to prevent a user from seeing the same ads more than once. Via a cookie ID, Google records which ads are shown in which browser and can thus prevent them from being shown more than once.

In addition, DoubleClick can use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later uses the same browser to visit the advertiser's website and make a purchase.

The data collected with DoubleClick is automatically deleted after one year. We only use DoubleClick with your consent, Art. 6 para. 1 p. 1 lit. a GDPR. Google acts as the data controller for Google Ads and may process your personal data for other purposes. We have no influence on the data or the scope of data collection by Google. We also have no knowledge of the content of the data transmitted to Google. Details on data processing by Google can be found at: https://policies.google.com/privacy.

For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Google and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. in the USA) compared to the level of data protection in the EU.

(4) Pinterest

This website uses the conversion tracking function of Pinterest, a service of Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland, for usage-based visitor targeting. For this purpose, a so-called pixel tag is integrated on this website. This is a code snippet that provides Pinterest with insight into a person's activities on our website. Pinterest uses this information to improve the display of advertising, to assess and improve the effectiveness of ads on Pinterest or to determine what type of advertising should be displayed to users. For tracking purposes, Pinterest also sets cookies that collect, for example, your IP address, information about your browser and usage behavior. We are provided with statistical data about the use of our website and the use of our Pinterest ads by Pinterest based on this information.

The data collected by Pinterest is automatically deleted after the browser session ends or after one year.

We only use the Pinterest services with your consent, Art. 6 para. 1 p. 1 lit. a GDPR. Pinterest acts as a data controller and may process your personal data for other purposes. We have no influence on the data or the scope of data collection by Pinterest. For details on data processing by Pinterest, please visit: https://policy.pinterest.com/de/privacy-policy and for your settings options, please visit: https://help.pinterest.com/de/article/personalized-ads-on-pinterest.

For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Pinterest and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. the USA) compared to the level of data protection in the EU.

(5) LinkedIn

This website uses the conversion tracking function of LinkedIn, a service for usage-based visitor targeting provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. This service sets cookies in your web browser, which enable the collection of, for example, your IP address, device and browser information and website events (visits). This function makes it possible to recognize so-called conversions from LinkedIn (i.e. when users have come to our website as a result of our LinkedIn ads or articles). In addition, LinkedIn offers the possibility of so-called retargeting via the service. This allows us to display targeted advertising outside of this website without identifying you individually. LinkedIn sets cookies that expire within 30 days or 90 days. A cookie that records the status of your opt-out of third-party tracking expires within 10 years. You can find more information about the individual storage periods at: https://de.linkedin.com/legal/l/cookie-table?.

We only use LinkedIn services with your consent, Art. 6 para. 1 p. 1 lit. a GDPR. The transfer of data to LinkedIn is based on Art. 28 GDPR in conjunction with the respective data processing agreement. LinkedIn may process personal data outside the EU / EEA. For the transfer of your personal data to third countries, we have concluded EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with LinkedIn and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. the USA) compared to the level of data protection in the EU.

(6) Taboola

This website uses the discovery platform "Taboola" provided by Taboola, Oneustonsq, 40 Melton Street, 13th Floor, London, NW1 2FD, United Kingdom. Taboola enables us to show users the most attractive promotional content possible based on their interests. To do this, Taboola sets cookies to find out what content users interact with, which of our pages users visit, and whether users have accessed our website by clicking on a Taboola ad. The information collected for this purpose includes IP addresses, unique user IDs, websites visited, device-related information (e.g. operating system), and information about previously visited websites.

The cookies set by Taboola partially expire when you end your browser session or after 1 or 2 years. You can find more information about the individual storage periods at: https://www.taboola.com/de/policies/cookie-richtlinie.

We only use Taboola with your consent, Art. 6 para. 1 p. 1 lit. a GDPR. Taboola acts as a data controller and may process your personal data for other purposes. We have no influence on the data or the scope of data collection by Taboola. Details of Taboola's data processing can be found at: https://www.taboola.com/de/policies/datenschutzerklaerung.

Taboola may transfer your personal data to countries outside the EU / EEA. The transfer of your personal data to Taboola to the UK is based on an adequacy decision by the European Commission for that country. For transfers of your personal data to third countries that do not have an adequacy decision, we have entered into EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Taboola and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. the USA) compared to the level of data protection in the EU.

(7) Facebook

We use the so-called "Facebook pixel" provided by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook") on our website. This makes it possible to track the behavior of users after they have been redirected to this website by clicking on a Facebook ad. Via the Facebook pixel, for example, information about your browser session on our website, a hashed version of your Facebook ID and the accessed URL are transmitted. This process is used to evaluate the effectiveness of Facebook ads for statistical and market research purposes and can help to optimize future advertising measures.

The Facebook pixel is deleted 180 days after your last interaction with our website. Facebook provides us with aggregated reports that enable us to improve the quality and relevance of our ads on Facebook and present more relevant ads to Facebook users for improved marketing.

We only use the Facebook pixel with your consent, Art. 6 para. 1 p. 1 lit. a GDPR We and Facebook are Joint Controllers for data processing through the Facebook Pixel pursuant to Art. 26 GDPR and have entered into an agreement to this effect. You can view this agreement here: https://www.facebook.com/legal/controller_addendum. You can assert your data protection rights directly with Facebook.

Facebook may process personal data outside the EU / EEA. For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded the EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with Facebook and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g., the USA) compared to the level of data protection in the EU.

4. Data security

Ziegert EverEstate GmbH takes technical and organisational security measures to protect the data we have under our control against manipulation, loss, destruction and against access by unauthorised persons. Our security measures are continuously updated and improved in line with technological developments. In particular, this site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as enquiries that you send to us as site operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

5. Career

You can also apply to Ziegert EverEstate GmbH electronically. This is done via Personio GmbH, which provides the electronic applicant management platform. The following data will be collected: Name, date of birth, address, e-mail and your application documents. Of course, we will only use your details to process your application and will not pass them on to third parties. Please note that unencrypted e-mails are not protected against unauthorised access. Please refrain from attaching sensitive data to your application. Sensitive data means personal data revealing your ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data for unique identification, health data or data concerning your sex life or sexual orientation. The data processing is based on § 26 para. 1 BDSG. The data will be deleted within 6 months after completion of the application process. If you conclude an employment contract with Ziegert EverEstate GmbH, the data required for the implementation of the employment relationship will be stored beyond this and deleted in accordance with the legal requirements.

6. Newsletter

You will only receive promotional information sent to your e-mail address if you have consented to the use of your e-mail address for this purpose. To receive our newsletter, you must provide your e-mail address. Before the newsletter is sent, you must explicitly confirm that you want us to activate the newsletter service for you using the so-called double opt-in procedure. For this purpose, you will receive a confirmation and authorisation e-mail from us, with which we ask you to click on the link contained in this e-mail and thus confirm to us that you would like to receive our newsletter. This data processing is based on Art. 6 para. 1 p. 1 lit. a GDPR. In addition, we may use your e-mail address for direct advertising of our own goods or services that are similar to goods and services that you have purchased from us, provided that you have not objected to the use of your e-mail address for this purpose. In this case, the legal basis is § 7 para. 3 UWG, Art. 6 para. 1 p. 1 lit. f GDPR. You can revoke your consent at any time with effect for the future or object to the use of your e-mail address for the purpose of direct advertising, e.g. via the following e-mail address: contact@everestate.com or via the link contained in every newsletter. To retrieve the information we have stored about you for this purpose, send us an email to contact@everestate.com.

a) Use of the dispatch service provider GetResponse

The newsletter is sent using GetResponse, an offer of GetResponse S.A. (limited liability company under Polish law), Arkonska 6/A3, 80-387 Gdansk, Poland.

GetResponse is a web-based platform that provides tools to build, manage and store a mailing list. The platform is stored on servers in Poland, France, Germany and the United States. GetResponse uses the email address to send and evaluate newsletters on our behalf. However, GetResponse does not use your data to write to you itself or to pass it on to third parties.

For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded EU standard contractual clauses with GetResponse (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. the USA) compared to the level of data protection in the EU.

We trust in the reliability and IT and data security of GetResponse. We have concluded a data processing agreement with GetResponse. This is a contract in which GetResponse undertakes to protect the data of our users and to process it exclusively on our behalf. You can view The legal basis for the data transfer is Art. 28 GDPR in conjunction with the respective datat processing agreement.

The newsletters contain a so-called "web beacon", (invisible graphics), i.e. a pixel-sized file that is retrieved from the GetResponse server when the newsletter is opened. Within the scope of this retrieval, technical information, such as information on the browser and your system, as well as your IP address and the time of the retrieval are initially collected. This information is used for the technical improvement of the services based on the technical data or the target groups and their reading behaviour based on the retrieval locations (which can be determined with the help of the IP address) or the access times.

Statistical surveys also include determining whether newsletters are opened, when they are opened, and which links are clicked on. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is not our endeavour, nor the endeavour of GetResponse, to observe individual users. Rather, the evaluations serve to identify the reading habits of our users and to adapt our content to these or to send different content according to the interests of our users. The legal basis for carrying out the statistical surveys and analyses as well as logging the registration process is Art. 6 para. 1 p. 1 lit. f GDPR. Our legitimate interest is the use of a user-friendly and secure newsletter system that serves our business interests and meets the expectations of our users.

b) Use of the dispatch service provider MessengerPeople

MessengerPeople, Herzog-Heinrich-Str. 9, 80336 Munich, enables the dispatch of newsletters in various messengers. The legal basis for the transfer of data to MessengerPeople is Art. 28 GDPR in conjunction with the respective data processing agreement. By sending a start message and giving your consent to the telephone number provided by us, you consent (i) pursuant to Art. 6 para. 1 lit. a GDPR to the use of your personal data (e.g. surname and first name, telephone number, messenger ID, profile picture, messages) for direct communication with us and data processing required for this purpose using the respective messenger selected, as well as (ii) to receive promotional information about our products and services. An existing messaging account with the respective provider is required to use this service.

The responsible provider of the messenger is:

Whatsapp: WhatsApp, Inc., 1601 Willow Road, Menlo Park, California 94025, USA with the privacy policy available at https://www.whatsapp.com/legal/#privacy-policy.

Facebook: Messenger Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA with the privacy policy available at facebook.com/about/privacy Telegram: Telegram Messenger LLP 71-75 Shelton Street, Covent Garden, London, United Kingdom with the privacy policy available at https://telegram.org/privacy

Insta News: Pylba Inc, 314 27th Avenue, San Mateo, CA, 94403, USA with the privacy policy available at apps.pylba.com/privacy In doing so, the respective provider receives personal data (in particular metadata of the communication), which is also processed on servers in countries outside the EU (e.g. USA). For further information, please refer to the privacy policy of the respective messenger above. For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) with the respective provider and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g., the USA) compared to the level of data protection in the EU. The sender has neither precise knowledge nor influence on the data processing by the respective provider.

Your consent to the sending of promotional information can be freely revoked at any time by entering "STOP" in the respective messenger. To have all of your data stored by us in the course of communication with MessengerPeople removed, send a message with the text "DELETE ALL DATA" via your messenger.

c) Invitation management via MATE

The names, e-mail address, telephone number of our e-mail recipients are transmitted to MATE Development GmbH, Rankestraße 9, 10789 Berlin, Germany in the context of invitations to events. In doing so, MATE uses this information to send and evaluate the e-mails on our behalf on the basis of Art. 28 GDPR and an order data processing contract. However, MATE does not use the data of our e-mail recipients to write to them itself or to pass them on to third parties. The legal basis for sending is Art. 6 para. 1 p. 1 lit. a GDPR (see above). The evaluation is based on Art. 6 para. 1 p. 1 lit. f GDPR. We have a legitimate interest in evaluating the success of our e-mail dispatch.

7. Telephone registration and telephone calls

In the case of telephone calls, we will, if you wish and expressly consent to this, record your telephone number and name, as well as possible real estate wishes, for further discussions, offers and consultations. The legal basis in this case is Art. 6 para. 1 p. 1 lit. b GDPR. The data is required for the initiation of the contract or the fulfilment of your request.

8. In principle, no disclosure to third parties

As a matter of principle, we do not pass on any data to third parties - except in the cases mentioned in this data protection information - unless you have expressly consented (e.g. by filling in a form to contact an estate agent) or this is provided for by law. In particular, data is also exchanged with other companies of the Ziegert Group in principle only insofar as the exchange is necessary in the context of the execution or initiation of the contract. Further data is passed on under strict contractual and legal conditions: To external service providers for data processing: If service providers come into contact with personal data of our customers (e.g. for the purpose of sending requested information brochures, web tracking or coverage measurement), this takes place within the framework of so-called commissioned data processing. This is expressly provided for by law (Art. 28 GDPR). Ziegert EverEstate GmbH remains responsible for the protection of your data even in this case. The service provider works exclusively in accordance with our instructions, which we ensure through strict contractual regulations, through technical and organisational measures and through supplementary controls. Due to legal obligation: In certain cases, we are legally obliged to transmit data to a requesting government agency. In these cases, the legal basis is Art. 6 para. 1 p. 1 lit. c GDPR.

9. Storage periods

Unless otherwise explained in this Privacy Policy, personal data will be stored for as long as necessary for the relevant processing purpose. Subsequently, the data will be deleted unless further data storage is required or justified by law.

10. Transfer of personal data to third countries

When you use our services, your personal data may be transferred to recipients in other countries, including outside the EU/EEA. Please note that data processed in countries outside the EU/EEA may be subject to foreign laws and may be accessible to local governments, courts, law enforcement and regulatory authorities.

Unless otherwise stated in this privacy policy, we transfer personal data to recipient countries for which an adequacy decision has been issued by the European Commission. Where an adequacy decision does not exist for a recipient country, we transfer your personal data only on the basis of appropriate safeguards, such as EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en) or where another exception under Article 49 GDPR applies. In addition, we take further security measures to the extent necessary to compensate for a lower level of data protection in the respective recipient country compared to the level of data protection in the EU.

Please contact us (see the "Contact" section) if you would like more information about the specific security measures applied by the recipients of your personal data.

11. Automated decision-making

No decision based solely on automated processing, including profiling, which produces legal effects vis-à-vis you or similarly significantly affects you, will take place.

12. Your data protection rights

You have the following data protection rights, depending on the circumstances of the specific case:

To request access to and/or copies of your personal data. This includes information about the purpose of the use, the category of data used, its recipients and persons authorised to access it and, if possible, the planned duration of data storage or, if this is not possible, the criteria for determining this duration;

To request the rectification, erasure or restriction of the processing of your personal data where its use is unlawful under data protection law, in particular because (i) the data is incomplete or inaccurate, (ii) it is no longer necessary for the purposes for which it was collected, (iii) the consent on which the processing was based has been withdrawn, or (iv) you have successfully exercised a right to object to data processing; in cases where the data is processed by third parties, we will forward your requests for rectification, erasure or restriction of processing to those third parties, unless this proves impossible or involves a disproportionate effort;

Refuse consent or - without affecting the lawfulness of the data processing carried out before the withdrawal - withdraw your consent to the processing of your personal data at any time;

To request the personal data relating to you that you have provided to us in a structured, commonly used and machine-readable format and to transfer this data to another controller without hindrance from us;

You may also have the right to request that we transfer the personal data directly to another controller, where technically feasible;

Take legal action or refer the matter to the relevant supervisory authorities if you believe that your rights have been infringed as a result of processing of your personal data that does not comply with data protection law.

In addition, you have the right to object to the processing of your personal data at any time:

where we process your personal data for direct marketing purposes; or

if we are processing your personal data for the pursuit of our legitimate interests and there are grounds based on your particular situation.

To exercise your data protection rights, you can contact us at any time using the contact details provided in the "Contact" section.

13. Adaptation and amendment of the privacy policy

We reserve the right to adapt this privacy policy if technical circumstances or legal requirements change.

14. Contact

Your trust is important to us. If you have any questions regarding the processing of your personal data, please do not hesitate to contact us:

Ziegert EverEstate GmbH Zimmerstraße 16, 10969 Berlin

E-mail: contact@everestate.com

You can reach our data protection officer at datenschutzbeauftragter@ziegert-immobilien.de.

Date: September 2022