Privacy notice

Controller

Please use these contact details for privacy enquiries and to exercise your rights.

Privacy contact: Sebastian Kraus, datenschutz@ggd.de.

Website access and hosting

Accessing this website involves the processing of technical connection data, in particular your IP address, access time, requested address or file, browser and operating system information, and technical status and error information. A referring page may also be received where your browser sends it. This processing enables us to deliver the website, investigate faults and protect it against misuse and attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

The website is provided through OpenAI Sites. The provider for customers in the European Economic Area is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Cloudflare infrastructure is used for technical delivery and website protection. These providers process technical connection data as part of delivering the service. Processing on our behalf is governed by the applicable hosting agreements.

IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, provides domain administration and DNS. The website itself is not served through IONOS web hosting.

The website application does not write permanent access logs. Technical connection data is processed to handle the relevant request. Where hosting providers additionally maintain security and error logs, retention depends on what is necessary for operation, fault analysis and prevention of misuse. Longer retention may be necessary to investigate specific security incidents or meet legal obligations. You can contact our privacy contact for information about the relevant processing by hosting providers.

Password access and necessary cookie

The website is protected by a shared password. The password you enter is transmitted to our server over an encrypted connection and checked for validity. No individual user account is created.

After successful authentication, we set the ggd_session cookie. It contains an expiry time and a cryptographic verification value so you can access protected pages during the access period. It expires after 24 hours, is transmitted only over HTTPS and cannot be read by page scripts. The password itself is not stored in the cookie. You can delete the cookie earlier in your browser; you will then need to enter the password again.

This cookie is necessary to provide the access you request. Its storage and retrieval are based on section 25(2)(2) of Germany’s TDDDG. Related personal data processing is based on Article 6(1)(f) GDPR and our legitimate interest in restricting access to authorised visitors.

To protect against repeated incorrect password entries, the server instance temporarily holds an IP address, the start of the checking period and the number of failed attempts in memory. The checking window is 15 minutes. Expired entries are cleared when a further login request is received and are also lost when the server instance ends. The corresponding entry is removed after successful login. The website does not maintain a permanent login database for this purpose. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is preventing unauthorised access.

When you dismiss the cookie notice using “Understood”, we store your acknowledgement in the ggd_privacy_notice cookie for 180 days. It contains only the version of the acknowledged notice and prevents the notice being shown on every visit. It contains no personal identifier and is not used for advertising or visitor analytics. Storage of your chosen display setting is based on section 25(2)(2) TDDDG; related processing is based on Article 6(1)(f) GDPR and our legitimate interest in displaying privacy information in a user-friendly way. Select “Cookie notice” to open it again. Deleting this cookie in your browser resets the acknowledgement.

Fonts

Inter and Manrope are hosted locally and delivered through our website. Loading these fonts does not establish a connection to Google Fonts.

Email and telephone enquiries

When you contact us, we process the information you provide, such as your name, company, email address, telephone number, space requirements and the content of your enquiry. We use this information to respond, ask necessary follow-up questions and prepare requested offers.

Where processing relates to a contract with you or steps requested by you before entering into a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, including those from a company’s contact person, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is responding to business enquiries and communicating with prospective tenants.

We use IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, for our email mailboxes. We answer calls ourselves. We do not use an external call centre or an AI telephone assistant and do not record calls. We do not use an additional CRM to process these enquiries.

WhatsApp Business enquiries

We use WhatsApp Business to respond to enquiries. The WhatsApp button is a link to an external service, rather than an embedded chat. WhatsApp is opened only when you select the link. WhatsApp Ireland Limited provides the service for users in the European Economic Area. When used, WhatsApp processes connection, device and usage data under its own privacy information.

If you send us a message there, we process your telephone number, any profile name and your message to deal with your enquiry. The legal bases for our handling of your enquiry are those stated in the contact section above. Using WhatsApp is optional; you can also contact us by email or telephone.

WhatsApp’s processing is additionally described in its Privacy Policy. Data may also be processed outside the European Economic Area. Please do not send particularly sensitive information through this contact channel.

Images, maps and external links

Photographs and location graphics are delivered directly through our website. No external map service is embedded. Links to other providers’ project pages open those services only when selected. Their own privacy information applies to those services.

Retention and recipients

We delete enquiries that do not lead to a contract twelve weeks after the enquiry has been closed. This applies to email and WhatsApp Business enquiries and any notes taken during calls. We retain them longer only where required by law or where necessary to establish, exercise or defend legal claims. Where a contract is concluded, the necessary data is processed further to perform it. Business records subject to statutory retention are kept for the applicable commercial or tax-law period and then deleted. The separate information above applies to technical access data and the login cookie.

Within our company, access is limited to people who need the data for the stated purposes. External recipients include the hosting and communications providers described above, together with their relevant subprocessors. Further disclosures take place where necessary to provide a service you request or where required by law.

Processing outside the European Economic Area

International hosting infrastructure and the external contact provider WhatsApp may involve processing outside the European Economic Area, particularly in the United States. OpenAI’s hosting data processing terms provide for an applicable adequacy decision or EU Standard Contractual Clauses for its transfers. Further details are available in the hosting data processing terms and subprocessor list. WhatsApp’s linked notice provides additional information about its international processing. You can also contact us for information about the safeguards used for our processing.

Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. Where processing is based on your consent, you may withdraw it at any time for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to object: Where we process personal data under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

You may lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. Our competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

Providing your information

You are not obliged to send an enquiry. Without contact details necessary to reply, we may be unable to deal with your enquiry. Technical connection data is required to deliver the website; protected content cannot be accessed without the shared password and necessary login cookie. The website does not make automated decisions with legal or similarly significant effects or conduct profiling of that kind.

Last updated: 22 October 2026.