Translation for information only. The German version is legally binding. German original

Privacy Policy

Version: 23 October 2026

In accordance with Art. 13 and 14 GDPR, the BDSG (German Federal Data Protection Act) and § 25 TDDDG (German Telecommunications Digital Services Data Protection Act), we inform you here which personal data we process when you use the German edition of the GREM real estate platform, for what purposes, on what legal basis, to whom they are disclosed, how long we store them and what rights you have.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is GREM CAPITAL LIMITED, 54 Kestrel Avenue, SE24 0EB London, Vereinigtes Königreich, e-mail: [email protected] (hereinafter “we” or “GREM”). Further information can be found in the Legal Notice. Please address questions on data protection and requests concerning your rights to [email protected].

2. Overview and definitions

2.1 Scope

This Privacy Policy applies to:

the website de.grem.capital;
the user account in the web browser at cabinet.grem.capital, including the web application that can be installed on the home screen (hereinafter the “GREM account”), insofar as it is operated in German mode; an account has this mode if its account country is Germany, including as an employee of an agency in Germany, and, for owners, any account with a property in Germany;
the mobile GREM apps for Android and iOS, insofar as you use them with such an account.

For other GREM services, the general privacy policy at grem.capital/de/privacy applies; for requests concerning properties outside Germany, see Section 7.6. The contractual terms can be found in the General Terms and Conditions for Brokers and the General Terms and Conditions for Owners. Our services are directed at persons of legal age.

2.2 Definitions

Brokers are real estate brokers, agencies and their employees who use the Platform professionally. Owners are sellers and landlords, prospects are prospective buyers and tenants. In Swipe Match, owners and prospects choose a broker, and brokers accept requests. A contact is the transmission of the contact details of an owner or prospect to the chosen broker. Processors process data on our behalf and in accordance with our instructions (Art. 28 GDPR).

2.3 Legal bases

For each processing operation, we state the legal basis: consent (Art. 6(1)(a) GDPR), contract or pre-contractual measures, in particular the GTC (point (b)), legal obligation (point (c)) or legitimate interest (point (f)). The storage of information on your terminal equipment and access to it are governed by § 25 TDDDG: they are permitted only with your consent (paragraph 1), unless they are strictly necessary in order to provide a service expressly requested by you (paragraph 2 no. 2).

We do not request special categories of personal data (Art. 9 GDPR), such as health data. Please do not enter such data in free-text fields, chats or documents either.

3. Operation of the Platform

3.1 Server logs

Each time the website, the GREM account or the app interfaces are accessed, our servers process the IP address, date and time, the address accessed, browser and device type, status code and, if you are logged in, the internal identifier of your account. In the request log, we also store excerpts of the request and response content of up to 10 KB per operation; passwords, codes, access keys, telephone numbers, e-mail addresses and names in contact details are automatically masked beforehand.

The purpose is secure and stable operation, defence against attacks and misuse, and troubleshooting (Art. 6(1)(f) GDPR). We delete the request log after 90 days and technical log files after 30 days.

3.2 Hosting

We operate our servers with OVHcloud in data centres in Gravelines (France), Limburg (Germany) and Erith (United Kingdom); technical monitoring runs in Warsaw (Poland). The database is mirrored in three data centres. Uploaded files such as photos and documents are stored on these servers or in OVHcloud’s object storage in Germany. Until our migration is completed, older backups remain with Hetzner Online in Germany. The hosting service providers are processors; the legal basis is Art. 6(1)(b) and (f) GDPR. Regarding the United Kingdom, see Section 14.

3.3 Cloudflare

The website, the GREM account and the app interfaces are delivered via the Cloudflare network. Cloudflare provides our domain names and protects against attacks and overload; to this end, it receives the encrypted connection, checks the request and forwards it in encrypted form to our servers; in doing so, Cloudflare processes your IP address and the content of the requests. In addition, Cloudflare secures access to our servers, relays calls in the app (Section 12.3) and stores backups in the EU (Section 3.6). Cloudflare is a processor; the legal basis is Art. 6(1)(f) GDPR (secure and available platform).

3.4 Approximate location based on the IP address

From your IP address, we determine the country and city in order to show you properties in your region and to protect logins, for example in the case of a login from a new country. The database used for this purpose is located on our own server; your IP address is not transmitted to anyone for this purpose (Art. 6(1)(f) GDPR). Source: IP Geolocation by DB-IP.

3.5 Error diagnostics

The Sentry service may be used for troubleshooting on our servers. Telephone numbers and e-mail addresses are masked beforehand, and passwords and access keys are removed; the automatic transmission of information such as the IP address is disabled (Art. 6(1)(f) GDPR).

3.6 Data security and backups

We transmit data in encrypted form (TLS), store passwords only as a cryptographic hash value and restrict our employees’ access to what is necessary. We store backups with Cloudflare (R2) with storage location in the EU: the continuous backup of the database is deleted after 14 days, and nightly backups, which are encrypted beforehand, after 31 days. Earlier versions of modified or deleted files are retained in the file backup for at least 30 days. Data in backups are deleted in the regular deletion cycle and, until then, used only for restoration. The legal basis is Art. 6(1)(f) in conjunction with Art. 32 GDPR.

On your first visit to de.grem.capital, we display a banner with two buttons of equal standing: “Essential only” and “Accept all”. Until you choose “Accept all”, we do not load any Google tag, do not set any visitor identifier and do not send any visit data to our server.

By choosing “Accept all”, you consent to Google Analytics (Section 4.3), our own visit statistics (Section 4.4) and source information and referral links (Section 4.5). The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. We store your choice in the cookie grem_consent (180 days) and in local storage under grem_cookie_consent.

Withdrawal: Via “Cookie settings” in the footer of every page, you can reopen the banner and withdraw your consent at any time with effect for the future. If you choose “Essential only”, we remove the Google Analytics cookies and the source information cookies as well as the session identifier of the visit statistics; we do not read or use an existing visitor identifier without your consent.

4.2 Strictly necessary storage

Without consent (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR), we store only what is necessary for functions requested by you:

x-www-access (30 days, for the grem.capital domains), in the GREM account the local entry user: keeps you logged in; when switching from de.grem.capital to the GREM account, a one-time code valid for 60 seconds is used instead of the login key;
grem_consent and grem_cookie_consent (180 days): your choice in the banner;
i18next_de and i18nextLng, in the GREM account language and i18nextC (each up to 365 days): the language you have chosen;
grem_city (180 days) and grem_city_confirmed (30 days): the city chosen;
grem_agentlock (90 days): after a broker’s personal link, so that your request goes to that broker;
local entries for functions used (display, favourites, comparison, recently viewed, saved searches, search chat, last valuation, progress in Swipe Match, notices seen) and entries in session storage during login or registration, including the information that you came via de.grem.capital.

4.3 Google Analytics

Only with your consent do we use Google Analytics 4 on de.grem.capital. Pages accessed and interactions, information on device and browser, approximate location and referring page are recorded; statistics are generated from these. The Google tag is loaded only after “Accept all” and then sets cookies whose names begin with “_ga” (up to two years according to Google’s default settings). Only storage for analytics purposes is enabled in this process; the signals for advertising purposes (advertising cookies, user data and personalisation for advertising) always remain blocked on de.grem.capital. We do not use advertising tags from Google or other advertising networks. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR; regarding transfer to the USA, see Section 14.

In the GREM account in German mode, we do not load Google Analytics. If the GREM account recognises German mode only after your profile has loaded, for example on the first visit on a new device without going via de.grem.capital, we switch off any counter already loaded at that moment; the general privacy policy applies to the pages accessed before that. From the server, we do not send any events to Google Analytics for accounts in German mode.

4.4 Own visit statistics

After you have given your consent, we set the cookie grem_visitor_id with a random visitor identifier on de.grem.capital (365 days, for the grem.capital domains) and store a session identifier locally (grem_visit_session, 30 minutes). The page then transmits to our server the visitor and session identifiers, entry page, address of the landing page, referring page and campaign parameters from the address (utm parameters, click identifiers from Google and Facebook) and, when you view a property, its identifier. If you later log in to the GREM account, the identifier may be linked to your account. The purpose is to count visits and property views and to attribute requests to the channels through which visitors arrive. The data remain on our servers and are not passed on to advertising networks. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

If you submit a form without this consent, we transmit with the request only the campaign parameters of the current address and the referring page, without a visitor identifier and without storing anything on your device (Art. 6(1)(f) GDPR: attribution of the request to its channel).

4.5 Source information and referral links

Only after “Accept all” does de.grem.capital store the cookies grem_attribution (first source) and grem_attribution_last (last source), each for 365 days, with campaign parameters, click identifiers from Google and Facebook, landing page, referring page and time, and, in the case of referral links, the referrer’s identifier (refId, utm_short, ref_view_…, up to 365 days). The purpose is to attribute registrations and requests to campaigns and referrals (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Maps: We do not use Google Maps on de.grem.capital. We show the location of a property with a map from OpenStreetMap (coordinates via its Nominatim service), the catalogue and map view with map tiles from OpenFreeMap, and satellite images from Esri. These providers receive your IP address and information about your browser when the map is loaded (Art. 6(1)(f) GDPR).
Google reCAPTCHA: To protect our forms against automated entries and misuse, we load Google’s reCAPTCHA service only when you begin to fill in a form with this protection or submit it. In doing so, reCAPTCHA evaluates information about your device, your browser and your interaction and transmits it to Google. The legal basis is Art. 6(1)(f) GDPR; we consider the associated access to your terminal equipment to be strictly necessary to protect the form you are using (§ 25(2) no. 2 TDDDG).
Login via Google, Facebook and LinkedIn: These providers’ programs are loaded only when you open the login window; we do not show Google’s automatic login prompt (One Tap) on de.grem.capital (Section 5.2).
YouTube, Vimeo, Matterport and Kuula: Videos and 3D tours are loaded only when you select them in the gallery; YouTube preview images are loaded with the gallery. The provider receives your IP address and may set its own cookies (Art. 6(1)(f) GDPR: display of the media embedded by the provider of the listing).

4.7 Other services in the GREM account

Fonts are delivered from our own servers; we do not use Google Fonts;
Google reCAPTCHA is loaded on all pages of the GREM account in order to protect registration, login and forms against automated access; what is stated in Section 4.6 applies;
Google Maps displays maps and determines coordinates for property addresses when you enter location information or open maps (Art. 6(1)(b) and (f) GDPR);
Stripe provides the payment form when you initiate a payment (Section 11);
Firebase Cloud Messaging becomes active only if you yourself enable browser notifications; the identifier for this is stored in the browser (IndexedDB) (§ 25(2) no. 2 TDDDG);
Referral links: If you access the GREM account via a referral link, we store the referrer’s identifier (refId, utm_short) for 30 days in order to attribute your registration to the referral that you accessed with the link (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). If de.grem.capital has stored a visitor identifier and source information with your consent, the GREM account reads them after login in order to record the route by which you arrived.

During registration and when the password is changed, we check whether the password appears in known data leaks; for this purpose, only a short initial part of its hash value is sent to the Have I Been Pwned service, never the password itself (Art. 6(1)(f) GDPR).

4.8 Mobile apps

The app processes:

Device data: a token for push notifications (Firebase Cloud Messaging; on the iPhone, additionally the Apple Push Notification Service for calls), a random identifier of the installation, app version and platform – in order to deliver notifications and operate the app (Art. 6(1)(b) GDPR, § 25(2) no. 2 TDDDG);
Crash reports via Firebase Crashlytics, linked only to the internal identifier of your account and the app language; e-mail addresses and telephone numbers are masked in the logs (Art. 6(1)(f) GDPR: fixing errors; we consider access to your device to be strictly necessary for stable operation of the app, § 25(2) no. 2 TDDDG);
Usage statistics: For accounts in German mode, the app switches off Firebase Analytics as soon as your profile has loaded; the setting remains stored on the device. Before the first login, the app cannot yet identify your account; in that case, individual automatic events such as the first launch of the app may be sent to Firebase Analytics, without being linked to your account and without an advertising ID (Art. 6(1)(f) GDPR: measurement of installations).

The app uses the camera (photos, panoramas), microphone (voice messages, calls) and location (only Section 7.5) only with your permission. It does not read the address book, SMS or call log. The Android permission for the telephone number serves only to display incoming calls on the lock screen; the app does not send the number of your SIM card anywhere. On Android, the app displays maps with Google Maps; address search and place suggestions run directly from the device via Google (Art. 6(1)(b) GDPR).

5.1 Account

For your account, we process your name, e-mail address, password (only as a hash value), account country, language and role (for example broker, owner or prospect); brokers additionally state their federal state, because deadlines and public holidays depend on it. You may voluntarily add a profile photo, description, languages and further information. To protect your account, we store the IP address, device and approximate location for each login session. The legal basis is Art. 6(1)(b) GDPR, and point (f) for the security information.

You log in with your e-mail address and password, via a login link sent by e-mail, with a passkey or with your telephone number confirmed by SMS code, or alternatively via Google, Apple (in the app), Facebook or LinkedIn. In that case, we receive from the provider your name, your e-mail address and your identifier with that provider; the provider learns that you are logging in to GREM (Art. 6(1)(b) GDPR).

5.3 Telephone number and SMS code

We need your telephone number for login by SMS code, so that the broker chosen by you can reach you after accepting your request (Section 7), and so that we can contact you if you yourself have provided the number in a form, in your profile or in a request. Owners and prospects can send a request to a broker only after confirming their number; a mobile phone number can be confirmed for one owner account only.

The SMS codes are sent on our behalf by Zadarma; the service receives the telephone number, code and language. A code is valid for five minutes. We do not store the code but a cryptographic check value of it, and likewise of the IP address; the entry containing your telephone number is deleted 24 hours after the code expires. We store a confirmed number in your account (Art. 6(1)(b) and (f) GDPR).

5.4 Deletion of the account and copy of your data

You can delete your account yourself in the app (“Settings” → “Delete account”), in the GREM account (“Profile” → “Settings” → “Security” → “Delete account”) or without logging in at grem.capital/de/delete-account.

Thereafter, your profile, broker card and listings are no longer visible to others, you are logged out on all devices, notifications and newsletters are discontinued, your marketing consent is removed and pending requests are cancelled. Deletion in the account is initially a block: your account data remain stored in blocked form and are no longer used for other purposes, so that support can restore the account at your request and clarify questions about earlier transactions (Art. 6(1)(f) GDPR). There is currently no automatic final deletion after a fixed period. If you wish your data to be finally deleted, write to [email protected]: we will then delete all data that we are not required to retain for the reasons stated in Section 15. For data that we process on behalf of a broker, the periods set out in the data processing agreement in the annex to the General Terms and Conditions for Brokers apply.

We retain transactions, contracts, invoices, payments, reviews and the event log of requests even after deletion, insofar as this is required by law or for the purpose of providing evidence to other parties involved and defending against claims (Art. 6(1)(c) and (f) GDPR). Twelve months after deletion, we remove your own texts from the event log, for example reasons and comments; the entries recording what happened when remain. Likewise for twelve months, we store a check value of your telephone number generated with a secret key, so that brokers’ client protection and protection against misuse also take effect in the event of re-registration with the same number.

You can download a copy of your data as a file once a day in the GREM account (“Download my data”) and in the app: profile, contacts, consents, requests and their history, messages, reviews, payment transactions, notification settings and conversations with the AI assistant, without data of other persons.

6. Listings, photos and property data

6.1 Listings and photos

For a property, we process the address and location, type, floor area, rooms, price, year of construction, information from the energy performance certificate, characteristics such as heritage protection or heritable building right, description, photos, videos, panoramas and floor plans. Published listings are visible to visitors, in the case of brokers together with the broker card (Section 7.4), and appear in GREM’s shared property database, including for brokers abroad. Telephone numbers are not displayed in listings; prospects make contact by means of a request. If a broker sets up an export or a publication, we transmit the property data on the broker’s behalf to the chosen destinations, for example as an OpenImmo file to portals or to the broker’s connected social media accounts.

When uploading photos, owners confirm that they hold the rights to them and permit the chosen broker to use photos and materials from the packages for this property, including on portals. Please ensure that no persons, vehicle licence plates or personal documents are recognisable. The legal basis is Art. 6(1)(b) GDPR.

6.2 Evidence of heritage protection and heritable building right

For these characteristics, evidence may be uploaded (PDF or photo). We check whether the type of document, issuing body and address match the property. We read out the text of a PDF on our own server, and scans and photos with our own text recognition on our servers in the EU; we do not pass this evidence on to external AI services. If all characteristics match, the evidence is deemed provisionally confirmed and is subsequently reviewed by employees; otherwise, employees review it directly. Rejection is made only by employees, with reasons given by e-mail. We show a characteristic to buyers and in exports only if it has been confirmed.

The evidence can be seen only by the author of the property, the management of their agency and our responsible employees. We store it for as long as the property exists; if the property is deleted, we delete the files. In the case of rejected or not yet confirmed evidence, a record without the document (check value of the address, reason, author) is then kept for two years so that the same forged evidence cannot be submitted again (Art. 6(1)(b) and (f) GDPR).

6.3 AI valuation and report audit

The AI valuation is an automated estimate based on the information on the property, comparative data and statistical models, not an expert report. It also determines the category of an owner contact, or, without an AI valuation, your price information does (Art. 6(1)(b) GDPR). For the AI services used, see Section 10.

In the report audit, you upload a valuation report prepared by a third party, and we inform you of a review result. The report is read out by automated means, including with the support of AI; this takes place exclusively in the EU and without storage at the service used for this purpose. We use personal data contained in it only for the review; we delete the file 90 days after the review result has been communicated. We incorporate the value information, without personal data, into the data basis of our AI valuation and use it there even after the file has been deleted; we point this out at the time of upload. The legal basis is Art. 6(1)(b) GDPR, and point (f) for the anonymised value information.

6.4 Data from publicly accessible sources

We also take over information from publicly accessible property advertisements on other portals. We use it for the AI valuation and show the property details (type, location, area, rooms, price, description, photos) in the catalogue and on the map. We do not display the advertiser's name, telephone number or email address, do not pass them on to brokers or prospective buyers and do not contact the advertiser. Prospective buyers can send a search request for such an advertisement to a verified broker of their choice (Section 7).

Brokers on the Platform can also see public search requests from open sources (social networks, messengers, forums, classified ad portals): what the person is looking for, city, budget, a short text excerpt and a link to the original. We find such search requests using search services and evaluate them with AI (Section 10). We do not pass on contact details from these sources to brokers; the broker approaches the person where they published the search request.

The legal basis is Art. 6(1)(f) GDPR: realistic valuations, a complete overview of the market and bringing together searchers and brokers. If you do not want your advertisement or search request to be displayed, please object informally at [email protected]; we will then remove it from the Platform.

7. Requests, Swipe Match and disclosure of contact details

7.1 Principle: you choose for yourself

In the German edition, owners and prospects choose their broker themselves. GREM does not assign a broker to anyone, does not automatically forward requests to another broker and does not pass them on to a general group of brokers. Your contact details are received only by the broker chosen by you, and only with your consent, which we obtain when the request is sent and not already upon registration.

7.2 The individual cases

Owner chooses a broker: Your data and your property go to the chosen broker; only one request may be open at any one time.
Prospect chooses a broker on the property page or in a search request: Your data go to this one broker.
Request concerning a property: Your data go to the owner or to the broker chosen by the owner; if the owner’s request is still waiting for a broker, your request waits as well and goes to the broker who accepts.
Prospect via a partner broker, including one from abroad: You additionally confirm your consent via a link; your data are not transmitted before then.
Direct cooperation: If the owner has booked a package with direct cooperation, the owner receives the contact details of prospects and works with them via GREM’s telephony and chat; with a prospect of a partner broker, via that partner broker.

Until acceptance, the broker sees the request without contact details: type of contact, area, budget, time frame and verification badges. Upon acceptance, the broker receives your name and telephone number as well as your e-mail address and comment, if you have provided them, and, in the case of owners, also the information on the property. If the broker declines or the deadline expires, you choose the next broker yourself. Under the GTC, the broker may use your data only for your request and may not pass them on to brokers of other companies. The legal basis is your consent (Art. 6(1)(a) GDPR) and the performance of the brokerage you have requested (point (b)).

For each consent, we store the version and check value of the text displayed, the language, date and time, IP address, device and app version. The entries are only ever supplemented, never altered, and are retained for as long as we must prove the consent (Art. 7(1) GDPR) and claims arising from the brokerage can be asserted (Art. 6(1)(c) and (f) GDPR).

You can withdraw your consent at any time with effect for the future: by cancelling or withdrawing the request in the GREM account, with “STOP” in the chat of your request or as a reply to an automatic message in WhatsApp or Telegram, or by e-mail to [email protected]. Thereafter, we do not pass on your contact details to any broker whom you have not chosen yourself; an objection in a conversation also withdraws your consent to messages by SMS, messenger and e-mail. Data that a broker has already received are processed by that broker on its own responsibility (Section 7.7). In order to respect your objection, we store only hash values of your telephone number and e-mail address until you have it lifted.

7.4 Broker card, rating and order

We show owners and prospects broker cards with name, photo, company, area of activity, the “§34c verified” badge, rating R, number of properties in the vicinity, reviews, working languages and average response time; where there are fewer than three reviews, “New on GREM” is shown instead of R. Telephone number, e-mail address, website and chat appear only after acceptance; the broker’s legal notice is available on a separate profile page.

The rating is based on reviews by owners and prospects whose contact the broker has received, on feedback after the end of a cooperation (“Broker was not a good fit”) and on response behaviour: exceeded deadlines reduce it, declined requests do not. Reviews may be submitted only by owners and prospects whose contact was transmitted to that broker.

The order is determined by the GTC: the list for owners contains only brokers with the status “§34c verified” and an active plan, with the nearest at the top, showing the distance; the owner may extend the radius. On a property page with several brokers, they are listed by rating, the best first. In a search request, we show several matching brokers with the status “§34c verified”. We do not offer paid placement. The legal basis is Art. 6(1)(b) GDPR (contract with the broker) and point (f) (comprehensible selection for owners and prospects).

7.5 Event log and on-site appointment

We record the course of a request in an event log (choice of broker, acceptance, contact, appointments, conclusion, time and status of calls and messages via the Platform, credit notes), secured with a chain of check values. It serves to prove deadlines and processes to the parties involved, for example whether a broker made contact via the Platform within three days. We retain the event log for five years, as stated in the GTC (Art. 6(1)(b) and (f) GDPR). We store which broker cards you viewed, opened or skipped in Swipe Match, without contact details, for 180 days.

If a broker marks a meeting as “on site” and consents to this, the app determines the location of the broker’s phone once, only while the app is in use. Our server compares it with the map point of the property and discards it immediately; only whether the broker was no more than 300 m away and the time are stored. If the phone reports a simulated location, a moderator reviews the case. The legal basis for the location is Art. 6(1)(a) GDPR.

7.6 Properties outside Germany and partner transactions

For requests concerning properties and search areas outside Germany, the general privacy policy applies; there, with your express consent, a request may also go to a broker selected by GREM.

If a partner broker, including one from abroad, introduces a prospect for a property in Germany, the partner broker remains anonymous to the German broker until acceptance; both see names only after acceptance and payment for the contact. We record an agreement on sharing the commission in the event log and send both a confirmation as a PDF (Art. 6(1)(b) GDPR).

7.7 Brokers as independent controllers

Brokers, agencies and owners who receive your data via the Platform process them on their own responsibility in accordance with their own privacy notices. If a broker uses tools of the Platform for client management (CRM, chat, telephony, automatic replies via the broker’s own Telegram bot or WhatsApp Business number, AI tools), we process the data of the broker’s clients on the broker’s behalf in accordance with the data processing agreement in the annex to the General Terms and Conditions for Brokers. The broker uses services connected to their account, for example their own messenger or social media accounts, on their own responsibility.

8. Verification of brokers and agencies (§ 34c GewO)

8.1 Data

In Germany, only brokers with the status “§34c verified” may accept contacts and be displayed to owners and prospects. The status is applied for by the agency or the individual broker; employees of an agency take it over. We process the legal form, company name, authorised representative, number, authority, time limit and document of the licence under § 34c GewO (German Trade Regulation Code), tax number or VAT identification number, in the case of companies the register court, register number and an extract from the commercial register not older than three months, as well as the information for the legal notice.

8.2 Verification

We read out the documents partly by automated means and compare the number, authority, name or company name, time limit, register information, management and date with one another and with the legal notice on the broker’s website, which we access for this purpose via an encrypted connection. We read the text of a PDF on our own server, and scans and photos exclusively with our own text recognition on our servers in the EU. We do not transmit verification documents to external AI services.

The decision on approval is taken by a GREM employee; the automated reading merely provides the employee with indications. Reasons are given for a rejection. We inform you by e-mail 30 days before a time-limited licence expires; upon expiry, the status lapses until new evidence has been approved. We also compare the licence number, tax number, VAT identification number and the IBAN of the SEPA mandate so that the discounted trial period is granted only once per company (Section 17.2).

8.3 Visibility and storage period

The documents are kept in protected storage without public access; they can be seen only by the applicant and our responsible employees. The “§34c verified” badge and the broker’s legal notice are public. We store the documents for as long as the status exists. If a verification ends without an existing status, for example through rejection, withdrawal, a new application, expiry, revocation, deletion of the account or closure of the agency, we delete the files after 30 days. We retain the verification information without documents (in particular licence number and tax number, result and history) for as long as is necessary to prevent multiple use of the same licence and a repeated trial period.

The legal basis is Art. 6(1)(b) GDPR (contract with the broker) and point (f): showing owners and prospects only brokers with a valid licence and preventing misuse.

9. Proof of financing and capital provided by prospects

If, as a prospect, you upload proof of financing (financing confirmation, financing commitment or proof of capital; with a place of residence outside Germany and capital of €1 million or more, proof of capital or a bank reference letter together with an identity document), we process the information contained therein, in particular name, bank, amount and date.

We read out these documents for all prospects, regardless of their country, exclusively with our own text recognition on our servers in the EU; we do not transmit them to external AI services. Our employees then review each document before a verification badge is awarded. The broker does not receive the document; the broker sees only “Financing verified” or “Capital verified” and a range for the amount.

We delete the evidence and identity documents 90 days after the review; we also point this out at the time of upload. The legal basis is your consent (Art. 6(1)(a) GDPR); if you withdraw it, the verification badge lapses.

10. AI functions

10.1 Functions and providers

The Platform offers AI functions, for example an assistant, texts and translations, subtitles, speech output and transcription, photo editing and virtual furnishing, floor plans, videos and videos with an AI avatar, valuation, automatic replies for brokers and the evaluation of public search requests (Section 6.4). If you consent in a contact form, a GREM AI assistant may ask you follow-up questions about your request.

For this purpose, we transmit the content that you enter or upload (texts, photos, voice and video recordings, property information including the address) to the following providers:

OpenAI (USA): language models for the assistant including web search, automatic replies, texts, translations, video scripts, image recognition, image editing, floor plans, valuation, speech output and transcription;
Black Forest Labs and Replicate: editing and segmentation of photos;
HeyGen: videos with an AI avatar; for a personal avatar, the photos you provide are transmitted to HeyGen and used there to train the avatar;
ElevenLabs: speech output and music for videos;
Kling AI (processing in Singapore): videos from photos;
DeepL: translation of notifications;
Tavily and Serper: search services for public search requests;
Google Places: facilities in the vicinity of a property based on its coordinates.

OpenAI: We instruct OpenAI not to store responses. Under its terms, OpenAI may retain inputs and outputs for up to 30 days for the purpose of detecting misuse. Processing by OpenAI and by the other providers named is not limited to the EU (regarding third countries, see Section 14).

We read verification documents relating to § 34c GewO, evidence of heritage protection and heritable building right, and proof of financing and capital only with our own text recognition and do not pass them on to any of these providers (Sections 6.2, 8 and 9); Section 6.3 applies to the report audit. Simple photo enhancement runs on our own servers.

10.2 Storage and legal basis

We delete interim results of the AI services on our servers after 30 days; results that you save in your account remain until you delete them or the account is deleted. AI results are suggestions; please check them before use or publication. For an AI avatar, upload only your own image and sound recordings or recordings made with the consent of the person depicted.

The legal basis is Art. 6(1)(b) GDPR, your consent (point (a)) for follow-up questions from the AI assistant, and point (f) for the evaluation of public search requests.

11. Payments and invoices

11.1 Payment processing

We process payments via Stripe: card, Apple Pay, Google Pay and, for brokers, SEPA Core Direct Debit. You enter your card number and full IBAN with Stripe; we do not store them. From Stripe, we receive the payment status, the last digits of the card or IBAN, bank identifier, country, mandate number and mandate reference, as well as a check value of the IBAN. We transmit to Stripe the e-mail address, internal account identifier and, for invoices, the address and tax number. Insofar as Stripe processes data for its own purposes, for example for fraud prevention or for its own legal obligations, Stripe is itself the controller.

Before each SEPA direct debit, brokers receive the invoice stating the amount and the debit date. For brokers, limits on payment on account apply depending on the plan and payment history; after a failed direct debit or a returned direct debit, only card payment is possible until the balance has been settled. We do not carry out credit checks with credit agencies. Purchases in the app may also be made via the App Store and Google Play; these are recorded by the RevenueCat service with the internal identifier of your account. We do not offer purchases to German broker accounts in the apps from the App Store and Google Play.

11.2 Invoices, accounting and retention

Invoices under § 14 UStG (German VAT Act) contain the name or company name, address, tax number, services, amounts and method of payment; for brokers, in ZUGFeRD format. We file invoices, corrections and payment transactions in an archive whose entries can only be supplemented but cannot be altered or deleted. Our tax adviser receives invoice data as a DATEV-compatible file; tax advisers, auditors and the tax authorities are given access to the archive in the event of an audit, and every access is logged. The legal basis is Art. 6(1)(b) GDPR and point (c) in conjunction with the retention obligations under commercial and tax law, in particular § 147 AO (German Fiscal Code), § 14b UStG and, where applicable, § 257 HGB (German Commercial Code).

We retain invoices and payment records for eight years, books, records and evaluations (register of payment transactions, reconciliation reports, exports) for ten years, and commercial and business letters for six years, in each case from the end of the calendar year in which they were created. If you request deletion before then, we block these documents (Art. 17(3)(b), Art. 18 GDPR): they are then available only for accounting and audit purposes and are deleted once the period has expired.

12. Communication

12.1 E-mail

We send e-mails relating to your account, requests, payments and notifications via SendPulse; we also maintain recipient lists there with e-mail address, name, language, country and role. Links in our e-mails to our own pages contain campaign parameters from which we can tell via which notification you arrive. The legal basis is Art. 6(1)(b) GDPR.

You receive newsletters with product news and tips only if you have consented during registration, when subscribing or in the e-mail settings (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every such e-mail or in the e-mail settings.

12.2 SMS and push notifications

In addition to the SMS codes (Section 5.3), we send short notifications based on fixed templates via Zadarma, for example to brokers about a new contact. We deliver push notifications in the app and browser via Google’s Firebase Cloud Messaging, and call notifications on the iPhone via the Apple Push Notification service; for this purpose, Google and Apple receive your device’s token and the content of the notification. In the browser and in the web application, you receive push notifications only if you yourself allow them. You choose the types of notifications and night-time quiet hours in the notification settings. We store the token with your login session (until 30 days after the last activity). The legal basis is Art. 6(1)(b) GDPR, and point (a) for advertising.

12.3 Chat and calls

We store chat messages, including voice and video messages, in order to deliver and display them to the participants. Calls in the app are encrypted voice connections between the devices; the connection is set up via Cloudflare servers or our own servers, or alternatively via a Google service, which receive the IP addresses of the participants in the process. Calls from the GREM account via the Platform’s telephone system are relayed by Zadarma. Conversations are not recorded; we store the caller, the person called, time, duration, status and technical quality values as evidence. The legal basis is Art. 6(1)(b) GDPR.

12.4 Support and internal notifications

If you write to us by e-mail or via the contact form, we process your information (in the case of the form, your name, if provided, e-mail address and message) in order to deal with your enquiry (Art. 6(1)(b) or (f) GDPR). The contact form does not load any third-party services; to protect against misuse, we check the time taken to complete the form, a field invisible to humans and the number of requests per IP address and e-mail address (short-term counters, Art. 6(1)(f) GDPR). We reply to the e-mail address provided and do not send an automatic copy of your message. Our team receives internal notifications via Telegram, for example about new requests, registrations and logins including the source of the visit, payments and support enquiries; these may contain your name, your contact details and form entries. The purpose is prompt processing (Art. 6(1)(f) GDPR).

13. Recipients and processors

Within our company, your data are received only by persons who need them for their tasks. In addition, data are received by:

brokers, agencies and owners to whom you address a request or whose request you accept (Section 7);
processors: GREM CAPITAL LIMITED (London), insofar as it is not itself the provider, for the operation and further development of the technical platform; OVHcloud; Hetzner Online; Cloudflare; SendPulse; Zadarma; Google (Firebase Cloud Messaging, Google Maps Platform) and Apple (Apple Push Notification service); OpenAI, Black Forest Labs, Replicate, HeyGen, ElevenLabs and Kling AI; DeepL; Sentry, where used – in each case with the tasks stated in Sections 3 to 12;
other service providers for our own purposes: Google (Google Analytics after consent, Firebase Crashlytics and Firebase Analytics in accordance with Section 4.8, reCAPTCHA), OpenFreeMap, OpenStreetMap, Esri, Have I Been Pwned, Tavily, Serper and Telegram;
payment service providers: Stripe, RevenueCat, Apple (App Store) and Google (Google Play);
providers chosen by you or a broker: Google, Apple, Meta (Facebook) and LinkedIn for login, YouTube, Vimeo, Matterport and Kuula for embedded media, portals, social networks and messengers connected by brokers;
tax advisers, auditors and the tax authorities (Section 11.2);
authorities, courts and legal advisers, if we are obliged to disclose data to them or this is necessary for the establishment, exercise or defence of legal claims (Art. 6(1)(c) and (f) GDPR);
acquirers, if our company or parts of it are sold, within the statutory framework (Art. 6(1)(f) GDPR).

Processors are contractually bound by our instructions in accordance with Art. 28 GDPR. We do not sell data.

14. Transfers to third countries

Some recipients are located outside the EU and the EEA or process data there:

United Kingdom: Insofar as the controller or recipient is located in the United Kingdom, the transfer takes place on the basis of the adequacy decision of the European Commission. This also applies to the servers and the database copy in Erith.
USA: Recipients in the USA are in particular Google, Apple, Meta, LinkedIn, Cloudflare, Stripe, RevenueCat and OpenAI. Insofar as a recipient is certified under the EU-U.S. Data Privacy Framework, the transfer takes place on the basis of the adequacy decision of the European Commission of 10 July 2023, and otherwise on the basis of standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).
Other third countries without an adequacy decision, for example Singapore (Kling AI): on the basis of standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).
Brokers in third countries and services connected by you: If you work with a broker outside the EEA via the Platform or yourself connect an account with a social network or messenger, we transmit data because this is necessary for the performance of the service you have requested (Art. 49(1)(b) or (c) GDPR).

You can request a copy of the safeguards at [email protected].

15. Storage period

We store data only for as long as is necessary for the purpose or a statutory retention obligation exists:

Account and profile: until the account is deleted, thereafter in blocked form until final deletion at your request (Section 5.4), unless a longer period applies below;
Request for an SMS code (telephone number, check values of code and IP address): until 24 hours after the code expires;
Login sessions with IP address, device, approximate location and token for notifications: 30 days after the last activity;
Server logs: request log 90 days, log files 30 days;
Broker cards viewed in Swipe Match: 180 days;
Event log of a request: 5 years; your own texts in it are removed 12 months after deletion of your account;
Check value of the telephone number of a deleted account: 12 months;
Objection to disclosure to brokers: until it is lifted (hash values only);
Proof of consents: for as long as we must prove them and claims arising from the brokerage can be asserted;
Documents under § 34c GewO: for as long as the status exists; files of completed verifications without status 30 days; verification information without documents, for as long as necessary to prevent misuse;
Evidence of heritage protection and heritable building right: for as long as the property exists; in the case of rejected or unconfirmed evidence, thereafter a record without the document for 2 years;
Proof of financing and capital and identity documents: 90 days after the review;
Reports in the report audit: 90 days after the review result has been communicated;
Interim results of the AI services: 30 days; at OpenAI, under its terms, up to 30 days for the detection of misuse;
Invoices and payment records: 8 years; books, records and evaluations: 10 years; commercial and business letters: 6 years, in each case from the end of the calendar year;
Backups: database 14 or 31 days respectively; earlier versions of files at least 30 days;
Newsletter consent: until withdrawn;
Cookies and local storage: as stated in Section 4.

We store other data for as long as they are necessary for their purpose and the law requires it. If a retention obligation precludes deletion, we restrict the processing.

16. Your rights

You can assert your rights informally, most easily by e-mail to [email protected]; please state the e-mail address or telephone number of your account. If there are reasonable doubts as to your identity, we may request additional information (Art. 12(6) GDPR).

Access (Art. 15 GDPR) to the data processed about you and a copy thereof; you can download much of it yourself (Section 5.4);
Rectification (Art. 16 GDPR) of inaccurate data and completion of incomplete data; you can change many details yourself in your profile;
Erasure (Art. 17 GDPR), unless a retention obligation or another ground under Art. 17(3) GDPR precludes it; this also applies to data blocked after deletion of an account (Section 5.4);
Restriction of processing (Art. 18 GDPR), for example while the accuracy is contested;
Data portability (Art. 20 GDPR) of the data you have provided, in a structured, commonly used and machine-readable format;
Withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future, without affecting the lawfulness of processing carried out up to that point (see Sections 4.1, 7.3, 9 and 12.1);
Complaint to a supervisory authority (Art. 77 GDPR), in particular in the place of your habitual residence, your place of work or the place of the alleged infringement; in Germany, this is generally the data protection authority of your federal state.

Insofar as we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may object to processing for direct marketing purposes at any time without giving reasons; we will then no longer process your data for this purpose.

Please send your objection informally to [email protected].

17. Obligation to provide data and automated decisions

17.1 Obligation to provide data

You are under no statutory or contractual obligation to provide us with data. Without the data marked as mandatory, however, we cannot offer you an account or individual functions: without a confirmed telephone number, owners and prospects cannot send a request; without consent to the transmission, the chosen broker cannot contact you; and without the evidence under Section 8, brokers in Germany cannot accept contacts.

17.2 Automated decisions and profiling

We take decisions based solely on automated processing that produce legal effects or similarly significant effects (Art. 22 GDPR) in the following cases:

Brokers’ trial period (Art. 22(2)(a) GDPR): The discounted trial period is granted once per company. If the licence number, tax number, VAT identification number or IBAN of the SEPA mandate matches an earlier account, the discount lapses from the following billing month.
Payment on account (Art. 22(2)(a) GDPR): Limits on payment on account and the switch to card payment after a failed direct debit or returned direct debit are determined under the GTC by the plan and payment history.
Block following complaints about owners (Art. 22(2)(a) GDPR): If complaints are received from brokers of two different companies about the same owner (for example because the owner is not entitled to market the property or the property does not exist), the owner’s account is blocked in accordance with the General Terms and Conditions for Owners. We communicate the block and the reasons for it, an employee investigates the matter, the owner may comment, and if the complaints are unfounded, we lift the block. A single complaint is merely recorded.

In addition, we use automated procedures that do not constitute such decisions:

Order and rating: We calculate the order of the broker cards and the rating R automatically in accordance with Section 7.4. This constitutes profiling (Art. 4(4) GDPR); however, the selection is always made by the owner or prospect themselves.
Review of evidence: The status “§34c verified” is granted and refused by an employee. Evidence relating to properties may be provisionally confirmed automatically, but may be rejected only by employees. Proof of financing is always reviewed by employees.
Content and duplicate properties: We check content, accounts and duplicate properties partly by automated means, including with the aid of AI; doubtful cases are reviewed by employees.
Automatic credit notes to brokers, for example where a number does not exist, operate only in their favour.

You may contact [email protected] at any time, express your point of view, contest such a decision or measure and request review by an employee (Art. 22(3) GDPR).

18. Changes

We adapt this Privacy Policy when our services, the services we use or the legal situation change. The version published on this page with the version date stated above applies. We additionally inform registered users of material changes by e-mail or in the app. If a new processing operation requires your consent, we obtain it in advance.