1. Controller for data processing
Valtura Advisory OÜ
Ahtri tn 12, Harju Maakond, 15551 Tallinn, Estonia
E-mail: info@smartlandlord.de
Managing Director: Wolfgang Staufer
Data protection contact: datenschutz@smartlandlord.de
2. Legal bases for processing
Personal data are processed on the basis of the EU General Data Protection Regulation, GDPR (DSGVO). Depending on the purpose of the data processing, we rely on different legal bases:
- Art. 6(1)(a) GDPR: consent of the data subject
- Art. 6(1)(b) GDPR: processing for the performance of a contract
- Art. 6(1)(c) GDPR: processing for compliance with legal obligations
- Art. 6(1)(f) GDPR: processing to safeguard legitimate interests
3. Collection and storage of personal data
3.1 When you visit our website
- IP address of the accessing computer
- Date and time of access
- Name and URL of the file retrieved
- Website from which access is made (referrer URL)
- Browser used and, where applicable, the operating system
Obligation to provide: these data are collected automatically and are technically necessary to display the website. Without provision of these data the website cannot be loaded.
3.2 On registration and use
- Name and e-mail address
- Chosen password (stored in encrypted form)
- Usage data of the platform
- Documents uploaded and property data entered
- Communication with our support
Obligation to provide data: Your name, e-mail address and password are required for registration. Without these data you cannot use our service. Providing further property data is voluntary and enables you to use the platform's functions.
4. Use of third-party services
4.1 Payment service providers
Stripe (payments)
- Purpose: Processing of payments
- Data processed: Payment data, e-mail address, billing address Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
- Provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland
- Data transfer to the USA: Stripe is certified under the EU-US Data Privacy Framework
- Privacy policy: Stripe privacy policy
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Stripe
4.2 Hosting providers
Strato (web hosting)
- Purpose: Hosting of the website and database
- Location: Germany
- Data processed: All website data
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests)
- Legitimate interest: Our legitimate interest lies in providing our website securely, reliably and professionally.
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Strato.
Microsoft Azure (database)
- Purpose: Database hosting
- Location: Germany West Central (Frankfurt, Germany/EU)
- Data processed: User data, property data
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests)
- Legitimate interest: Our legitimate interest lies in a secure and scalable database infrastructure.
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR has been concluded with Microsoft for the database hosting.
- Privacy policy: Microsoft privacy policy (Trust Center)
4.3 Sending of e-mails
Strato e-mail service
- Provider: Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany
- Purpose: Sending of transactional e-mails (registration, password reset, notifications)
- Data processed: E-mail address, name, e-mail content Legal basis: Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interests)
- Location: Germany
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Strato
Twilio (SMS notifications)
- Provider: Twilio Inc., 101 Spear Street, San Francisco, CA 94105, USA
- Purpose: Sending of SMS notifications (e.g. two-factor authentication, important messages)
- Data processed: Telephone number, SMS content, timestamp
- Legal basis: Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(a) GDPR (consent for optional notifications)
- Data transfer to the USA: Twilio is certified under the EU-US Data Privacy Framework and uses standard contractual clauses
- Privacy policy: Twilio Data Protection Addendum
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Twilio
4.4 Maps and geodata
Google Maps API
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose: Displaying addresses that you enter on a map
- How it works: When you enter an address, only that address is transmitted to Google Maps in order to display the map. Your location is not determined.
- Data processed: Addresses entered by you
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests in user-friendly presentation)
- Data transfer to the USA: Google is certified under the EU-US Data Privacy Framework.
- Privacy policy: Google privacy policy
Overpass API
- Provider: Overpass API (open-source project, operated by, among others, FOSSGIS e.V., Germany)
- Purpose: Querying geographical data (points of interest, infrastructure, features of the surroundings) for location analyses and assessments
- Data processed: Search queries (addresses/coordinates); the queries are made server-side by our platform – your browser does not establish a direct connection to the Overpass API
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests in well-founded location analysis)
- Location: Servers in the EU
- Privacy policy: OpenStreetMap privacy policy
4.5 Artificial intelligence (AI services)
OpenAI API
- Provider: OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA
- Purpose: AI-supported functions (e.g. text generation, data analysis)
- Data processed: Texts and data entered by you that you release for processing
- Legal basis: Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interests)
- Data transfer to the USA: OpenAI uses standard contractual clauses for data transfers
- Privacy policy: OpenAI privacy policy
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with OpenAI
- Important notice: OpenAI processes your data in accordance with its own privacy policies. We recommend that you do not enter any sensitive personal data into AI-supported functions.
Perplexity AI
- Provider: Perplexity AI, Inc., USA
- Purpose: AI-supported research and data analysis
- Data processed: Search queries and texts entered
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests)
- Data transfer to the USA: Perplexity AI uses standard contractual clauses
- Privacy policy: Perplexity privacy policy
4.6 PDF generation
PDFShift
- Provider: PDFShift, France
- Purpose: Creation of PDF documents from web content
- Data processed: Content that is converted into PDF
- Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
- Location: EU (France) Privacy policy: Pdfshift privacy policy
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with PDFShift
4.7 Security and spam protection
Cloudflare Turnstile
- Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
- Purpose: Protection against automated access (bots, spam) to forms such as registration, login, password reset and contact enquiries
- Data processed: IP address, browser information, device-specific characteristics, anonymised behaviour patterns
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests in protection against misuse and in ensuring the security of the platform)
- Legitimate interest: Protecting our forms against automated attacks and spam bots
- Special feature: Unlike conventional CAPTCHA solutions, Cloudflare Turnstile sets no tracking cookies and does not use any data for advertising purposes
- Data transfer to the USA: Cloudflare is certified under the EU-US Data Privacy Framework. In addition, standard contractual clauses pursuant to Art. 46 GDPR apply
- Storage period: Request data are deleted after no more than 30 days
- Privacy policy: Cloudflare privacy policy
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare
4.8 Analytics and marketing
Google Analytics
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose: Analysis of user behaviour to improve our website
- Data processed: IP address (anonymised), page views, time spent on the site, device information, browser type, approximate location
- Legal basis: Art. 6(1)(a) GDPR (consent via the cookie banner)
- Cookie lifetime: Up to 2 years; Google is certified under the EU-US Data Privacy Framework
- Privacy policy: Google privacy policy
- Objection: You can prevent Google Analytics from collecting data by: - Declining in the cookie banner -
- Browser add-on: Browser add-on to deactivate Google Analytics
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Google
Google Tag Manager
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose: Management of website tags (technical implementation of analytics and marketing tools)
- Data processed: IP address, browser information Legal basis: Art. 6(1)(f) GDPR (legitimate interests in efficient tag management)
- Note: The Tag Manager itself does not collect any personal data, but enables other services (such as Google Analytics) to be loaded, which are already listed separately
- Privacy policy: Google privacy policy
LinkedIn Insight Tag
- Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
- Purpose: Conversion tracking, remarketing, audience analysis for LinkedIn advertising
- Data processed: IP address, browser information, page views, LinkedIn profile ID (if logged in)
- Legal basis: Art. 6(1)(a) GDPR (consent via the cookie banner)
- Cookie lifetime: Up to 180 days
- Data transfer to the USA: LinkedIn uses standard contractual clauses
- Privacy policy: LinkedIn privacy policy
- Objection: Decline in the cookie banner or in your LinkedIn settings under "Privacy"
4.9 Cloudflare (security & CDN)
Cloudflare
- Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
- Purpose: - Content delivery network (CDN) for faster loading times - DDoS protection and web application firewall - Performance monitoring (Cloudflare Insights)
- Data processed: IP address, browser information, requested URLs,
- access times Legal basis: Art. 6(1)(f) GDPR (legitimate interests in security and performance)
- Data transfer to the USA: Cloudflare is certified under the EU-US Data Privacy Framework
- Privacy policy: Cloudflare Customer Data Protection Addendum
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare Storage period: Log data are deleted after 24 hours
4.10 Content delivery networks (CDNs)
Google Fonts
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose: Provision of web fonts Data processed: IP address, browser
- information Legal basis: Art. 6(1)(f) GDPR (legitimate interests in uniform presentation)
- Data transfer to the USA: Google is certified under the EU-US Data Privacy Framework
- Privacy policy: Google privacy policy
External CDNs (cdnjs.cloudflare.com, cdn.jsdelivr.net, unpkg.com)
- Purpose: Fast delivery of JavaScript libraries and frameworks
- Data processed: IP address when the resources are loaded
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests in performance and loading times)
- Note: These CDNs deliver static files only (JavaScript, CSS) and carry out no tracking
4.11 Reviews and trust
Trustpilot
- Provider: Trustpilot A/S, Pilestræde 58, 5., 1112 Copenhagen, Denmark
- Purpose: Display of customer reviews to build trust
- Data processed: IP address when the Trustpilot widget is loaded
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests in transparency and building trust)
- Location: EU (Denmark)
- Privacy policy: Trustpilot privacy terms
- Note: If you submit a review yourself, Trustpilot's separate privacy policy applies
4.12 Our own infrastructure
Azure Blob Storage
- Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
- Purpose: Storage of uploaded files and documents Data
- processed: Uploaded documents, images, PDF files
- Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
- Location: EU (Germany)
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft Azure
- Privacy policy: Microsoft privacy terms
SmartLandlord CDN (cdn.smartlandlord.de)
- Purpose: Delivery of static content (images, CSS, JavaScript)
- Data processed: IP address when the resources are loaded
- Legal basis: Art. 6(1)(f) GDPR (legitimate interests in performance)
- Location: Germany/EU
- Operator: SmartLandlord LTD (separate group company, not the provider within the meaning of section 1)
- Data processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with SmartLandlord LTD
5. Cookies and consent management
5.1 Technically necessary cookies
These cookies are required for the operation of the website:
- Session cookies for your login
- Security cookies (CSRF protection)
- Storage of your cookie consent
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical operation)
Storage period: Session cookies are deleted at the end of the session, persistent cookies after 30 days
5.2 Analytics and marketing cookies
The following services set cookies that require your consent:
- Google Analytics (see 4.8)
- LinkedIn Insight Tag (see 4.8)
Legal basis: § 25(1) TDDDG (consent to the setting of cookies) in conjunction with Art. 6(1)(a) GDPR
You can withdraw your consent at any time via our cookie settings, or delete/block cookies in your browser.
5.3 Cookie management
When you first visit our website, a cookie banner appears in which you can set your preferences. You can change your settings at any time via:
- Cookie settings in the footer of our website
- Browser settings (these differ from browser to browser)
Note: Blocking certain cookies may impair the functionality of the website.
Technical security measures
- SSL encryption: All data transmissions are encrypted
- Password security: All passwords are stored in hashed form
- Access control: Strict authorisation concepts
- Regular updates: All systems are kept up to date
6. Storage period
- User data: Stored until your account is deleted, then deleted completely within 30 days
- Payment data: Not stored by us, only by Stripe
- Log files: Deleted automatically after 30 days
- Support communication: Retained for 2 years after the matter has been closed
- Contract-relevant data: Where retention obligations under commercial or tax law exist, we store data for up to 10 years (§ 257 HGB, § 147 AO).
7. Your rights as a data subject
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR)
Withdrawal of consent: Where processing is based on your consent (e.g. Google Analytics, LinkedIn Insight Tag), you can withdraw it at any time without affecting the lawfulness of the processing carried out up to the withdrawal.
Contact for data protection
If you have questions about data protection or wish to exercise your rights, please contact: datenschutz@smartlandlord.de
Reply within 30 days.
Note: We have not appointed a data protection officer, as the statutory requirements under Art. 37 GDPR are not met.
Important Notice
Automated decision-making (Art. 22 GDPR)
No solely automated decision-making with legal effect pursuant to Art. 22 GDPR takes place. The AI-supported analyses, valuations and recommendations of our platform (e.g. ImmoCheck) serve information purposes only and do not replace the user's own independent decision or professional advice.
8. Right to lodge a complaint with a supervisory authority
Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes applicable law.
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Competent supervisory authority
9. Status of and changes to this privacy policy
Status of this privacy policy
Last updated: May 2026
Version: 2.0