Prywatność

1. Controller

The controller for the processing of personal data on this website is RED Real Estates Development Bauträger und Immobilien GmbH, Sterngasse 3/2/6, 1010 Vienna, Austria, FN 58798 v, Commercial Court of Vienna. The company operates this website under the Sarego Group brand.

For data protection enquiries please use the buttons on this page or the postal address above. No data protection officer has been appointed, as the conditions of Article 37 GDPR are not met.

2. Visiting the website

When you open a page, your browser transmits technical data that our host processes in server logs: IP address, time, the address requested, status code, volume of data transferred, referrer and user agent. The legal basis is our legitimate interest in secure and stable operation (Article 6(1)(f) GDPR). These logs are not combined with other data.

Fonts are served from our own server. Opening a page therefore creates no connection to Google Fonts.

3. Forms

The website offers six ways to reach us: present a property, register a search profile, request database access, write a message, arrange a callback and speculative applications. We process what you enter, depending on the form this is your name, company, email address, telephone number, country and your details about the property or the search profile.

The purpose is to handle your enquiry and to initiate a business relationship. The legal basis is Article 6(1)(b) GDPR (pre-contractual steps) and, where you write on behalf of a company, Article 6(1)(f) GDPR (interest in answering business enquiries). The mandatory fields are required for us to reply; without them no enquiry is created.

Enquiries reach us by email. A copy is sent to the address you provided as an acknowledgement of receipt.

4. Retention

Enquiries that do not lead to a business relationship are deleted after twelve months. Where a business relationship arises, the statutory retention periods apply, in particular seven years under section 132 of the Austrian Federal Fiscal Code and the retention obligations under sections 365m et seq. of the Austrian Trade Act. Applications are deleted six months after the procedure has ended, unless you agree to longer storage.

5. Anti-money laundering obligations

As a real estate trustee we are subject to the due diligence obligations for the prevention of money laundering and terrorist financing (sections 365m et seq. of the Austrian Trade Act). Once a mandate is being initiated, we are obliged to establish your identity, determine the beneficial owner and clarify the source of funds. The legal basis is Article 6(1)(c) GDPR in conjunction with those provisions. This data is subject to the statutory retention period and is deleted only thereafter.

6. Recipients and processors

We use the following service providers. Data processing agreements under Article 28 GDPR are in place with all of them.

• Vercel Inc. (USA): hosting and delivery of the website.
• Resend (USA): sending the form and confirmation emails.
• Cloudflare (USA): Turnstile, the check for automated input. Turnstile runs in invisible mode and evaluates technical characteristics of the browser in order to protect forms against automated input. Details are set out in the Cloudflare Turnstile Privacy Addendum: www.cloudflare.com/turnstile-privacy-policy.
• IONOS SE (Germany): domain and email account.
• Google Ireland Limited (Ireland): Google Analytics 4, only with your consent.
• Microsoft Ireland Operations Limited (Ireland): Microsoft Clarity, only with your consent.

With Google and Microsoft, processing may also take place in the United States. For transfers to third countries we rely on the EU-US Data Privacy Framework where the respective recipient is certified, and otherwise on the European Commission's standard contractual clauses pursuant to Article 46(2)(c) GDPR. A level of protection equivalent to European law cannot be guaranteed in every case; in particular, access by authorities there cannot be ruled out.

7. Cookies and similar technologies

We set as few cookies as possible. A detailed list is available on the cookies page.

• NEXT_LOCALE: remembers the language selected. Necessary, valid for one year.
• sarego_consent: stores your decision on statistics and comfort analysis. Necessary, valid for six months.
• Cloudflare Turnstile: sets a short-lived token when a form is submitted, in order to detect automated input. Necessary.

Necessary cookies are set on the basis of section 165(3) of the Austrian Telecommunications Act 2021 and Article 6(1)(f) GDPR. Everything else only with your consent under section 165(3) of that Act and Article 6(1)(a) GDPR. You may withdraw your consent at any time via “Cookie settings” in the footer of every page; the withdrawal takes effect for the future.

8. Google Analytics 4

Only with your consent do we load Google Analytics 4 provided by Google Ireland Limited. The service measures which pages are opened, which form steps are reached and how visitors arrive.

We pass on type and state only, never field content: form_start, form_step, form_submit, contact_call_click, contact_message_open, portal_login_click, language_switch, menu_open. In Google Analytics 4, IP addresses are processed in truncated form by default. Advertising features, Google Signals and personalised advertising are switched off, and we do not assign a user ID. Before your consent, no script is loaded from Google and no connection to Google is established.

9. Microsoft Clarity

Only with your consent do we load Microsoft Clarity provided by Microsoft Ireland Operations Limited. Clarity records mouse movement, scrolling and clicks in order to improve usability. Form input and the contents of dialogs are masked and are not transmitted. Before your consent, no script is loaded from Microsoft.

10. Sarego database (portal)

For the protected area we keep a log of which user accessed or downloaded which property, which document and which data room, and when (see section 6.4 of the terms). The log serves as evidence that the opportunity was made known under section 6 of the Austrian Brokers Act and protects confidentiality towards the owners. The legal basis is Article 6(1)(b) and (f) GDPR. We also store the time and the version of the terms consented to.

11. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on a legitimate interest (Article 21). Consent once given may be withdrawn at any time with effect for the future.

You may also lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna.

12. Automated decisions

There is no automated decision-making including profiling within the meaning of Article 22 GDPR. Database access is decided by people.

13. Changes

We update this statement when the processing changes. The version published on this page applies.