Privacy information for our website, enquiries and customer service
Last updated: 24 October 2026. This notice explains how DeSH Real Estate GmbH processes personal data when you visit this website or use our property and financing brokerage services. Additional information in a specific form, engagement or participating provider’s notice applies to the processing described there.
1. Controller and contact
DeSH Real Estate GmbH, represented by Managing Director Yulin Zhou. Office: Böblinger Straße 23, 71229 Leonberg, Germany. Postal address for written correspondence: Riegeläckerstraße 49, 71229 Leonberg, Germany. Email: info@desh-realestate.com. Telephone: +49 176 34 68 2014.
Please send data protection requests to the email address above and postal correspondence to the postal address. We may need to verify your identity appropriately before processing a request.
2. Website visits, hosting and security
When you access this website, we process connection and access data needed for its operation. This may include your IP address, date and time, requested page, amount of data transferred, browser and operating system information, and, where applicable, the previously visited page. We use this data to deliver the website, investigate errors and protect against misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.
We use IONOS SE for hosting and email infrastructure. Technical logs are retained according to their operational and security purposes and the applicable logging periods of the service. Data needed to investigate a specific security incident or pursue legal claims may be retained longer. See IONOS privacy information.
3. Contact, enquiries and commissioned services
If you contact us by form, email, telephone or another channel you choose, we process your contact details, message and information needed to deal with your request. Depending on the matter, this may include property and ownership information, search criteria, appointments, contractual documents, and, for financing enquiries, income, equity, existing liabilities and financing plans.
We process this information to answer your enquiry or prepare or perform a contract under Article 6(1)(b) GDPR. For other enquiries, the basis is Article 6(1)(f) GDPR and our interest in appropriate communication. Processing required by law, particularly under commercial, tax or, where applicable, anti-money-laundering rules, is based on Article 6(1)(c) GDPR.
Fields marked as required are needed to handle the relevant matter; without them we may be unable to deal with it or provide the service. Optional information is not required for a general enquiry. Please send only documents relevant to your request, and do not send unsolicited health data or similarly sensitive information. Entering such data does not itself establish a legal basis under Article 9 GDPR. We rely on consent for specifically explained purposes, such as optional marketing contact (Article 6(1)(a) GDPR). Acknowledging a privacy policy is not blanket consent to unrelated processing.
4. Customer administration, documents and recipients
We use our internal customer system, iLogu brokerage software, and Nextcloud through Hetzner Online GmbH Storage Share to organise customer and property matters and to store, synchronise and collaborate on documents. Contact, property, communication and contract data may be processed. The legal basis depends on the matter, especially Article 6(1)(b), (c) or (f) GDPR; our legitimate interest includes orderly and secure business administration. See Hetzner’s privacy policy.
Recipients may include staff and advisers responsible for the matter and technical providers for hosting, email, customer administration, document storage and IT support. Depending on the requested or commissioned service, they may also include owners, landlords, prospective buyers or tenants, participating brokers, banks, financing platforms, valuers, property managers, notaries, tax advisers, legal advisers and public authorities. The data needed depends on each recipient’s task and the stage of the matter; no recipient automatically receives every document.
Technical providers that process data only on our behalf are subject to Article 28 GDPR. Banks, notaries, authorities and other participants may act as independent controllers for their own legal or contractual tasks. A necessary disclosure may be based on contract performance, pre-contract steps, legal duties or legitimate interests. Where consent is required, it must be given separately. This privacy policy replaces neither consent nor an engagement.
5. Cookies and similar technologies
Cookies and similar technologies may store or access information on your device. Strictly necessary operations are exempt under Section 25(2) TDDDG. Other such access requires consent under Section 25(1) TDDDG. Subsequent processing of personal data also requires a legal basis under the GDPR.
We use Complianz to manage your choices. Your settings and technical information needed to document them are processed so that we can respect and demonstrate those choices (Article 6(1)(c) GDPR where a statutory proof obligation applies, otherwise Article 6(1)(f)). You can change your choice using “Manage consent”. Withdrawal applies to the future. You can also delete stored cookies in your browser, in which case you may need to choose your settings again. Rejecting optional technologies may limit external maps, videos and other additional content. Consent to optional services is not a general prerequisite for contacting us by email or telephone. Details of the technologies, purposes and lifetimes appear in the consent dialog.
6. Integrated services and external content
When external content loads, its provider may receive connection data such as your IP address, browser information and the page visited. If you actively use the content, the information you enter may also be transmitted. Where consent is required, the basis is Article 6(1)(a) GDPR; Section 5 above also applies to device access. The legal bases for essential security functions and expressly requested services are described below.
Financing calculator — Europace
The German-language financing calculator is provided through Europace. It processes the property and financing parameters you enter, such as purchase price, equity, income and location, along with technical connection data. The purpose is the non-binding calculation you request and, where applicable, preparation of a financing enquiry (Article 6(1)(b) GDPR). Providing the requested calculator also serves our interest in a usable online service (Article 6(1)(f)), insofar as consent is not required. A calculation is not a credit decision or loan commitment. Please also read the privacy notice available in the calculator and Europace’s privacy information.
Property valuation — Betongold
The depreciation or remaining-useful-life page includes a form from Betongold Gutachten GmbH. The property, contact and, where applicable, order information sent there is used for the initial assessment or valuation service you choose. The integration assigns the referral to DeSH for cooperation and, where applicable, commission accounting. Betongold handles the requested valuation under its own responsibility. A free initial assessment is distinct from a paid valuation engagement. The enquiry is processed under Article 6(1)(b) GDPR; necessary referral allocation and settlement under Article 6(1)(f) (our legitimate interest in managing the cooperation), or Article 6(1)(c) where statutory evidence duties apply. Any optional marketing consent is separate. See Betongold’s privacy policy.
Maps, videos and reviews
The website uses Google Maps and YouTube content and displays customer reviews through Trustindex. They help show locations, explain our services and present customer reviews. When external content loads, technical data and possibly device identifiers may be sent to the provider; the provider may associate this with an account if you are signed in. Where consent is required, the basis is Article 6(1)(a) GDPR. For locally supplied content that does not involve such access, our interest under Article 6(1)(f) is to inform visitors about our company. An ordinary external link differs from directly loaded embedded content. Provider notices: Google/YouTube and Trustindex.
Spam and abuse protection — hCaptcha
We use hCaptcha to protect forms. It may evaluate IP address, browser and device information, and interactions to distinguish human input from automated abuse. Our legitimate interest under Article 6(1)(f) GDPR is protecting forms and IT systems. Where consent is required for device access or additional processing, Section 25(1) TDDDG and Article 6(1)(a) GDPR apply. The provider is Intuition Machines, Inc. (USA). See hCaptcha privacy information and hCaptcha GDPR information.
7. Transfers outside the EEA
International providers, particularly the Google services and hCaptcha mentioned above, may process data outside the European Economic Area. Articles 44 et seq. GDPR then impose additional requirements. Depending on the provider and transfer, the basis may be an applicable adequacy decision, in particular for an appropriately certified US recipient, or suitable safeguards such as EU standard contractual clauses with any necessary supplementary measures. Explicit consent under Article 49 GDPR is an exception, not a blanket basis for all international transfers. hCaptcha identifies EU standard contractual clauses as its transfer mechanism. Please consult the linked provider notices; you may also ask us which safeguards apply to a particular matter.
8. Retention periods and deletion criteria
Retention depends on the purpose, type of data and applicable legal duties. There is no single retention period for every customer document.
- Enquiries without a subsequent engagement: relevant factors are when handling is completed, whether a specific clarification remains necessary and what evidence is needed. A merely possible future contact does not justify keeping the entire enquiry indefinitely.
- Ongoing engagements and customer relationships: necessary data is used to carry out and settle the matter. After completion, we distinguish documents still needed under legal duties or to safeguard legal claims.
- Statutory retention: depending on document type, commercial and tax rules may require retention for six, eight or ten years. Start, duration and extensions follow the applicable rule, for example Section 257 HGB or Section 147 AO; particular evidence duties remain unaffected. These periods do not automatically cover every file in a customer record.
- Claims and disputes: documents needed to establish, exercise or defend specific legal claims may be retained until the relevant limitation period expires or proceedings conclude (Article 6(1)(f) GDPR).
- Consent records: withdrawal ends further use based on consent. Evidence of consent or withdrawal may be retained separately to meet proof obligations or defend legal claims.
When the relevant purposes have ended and no other legal basis remains, data is deleted or anonymised. Remaining statutory retention duties restrict further use to those purposes. Technical backups may be kept separately for their backup purpose; they do not create an independent right to reuse customer documents indefinitely. You may ask us which criteria apply to your data using the contact details above.
9. Your rights
Subject to the legal requirements, you have the rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time for the future; processing lawfully carried out before withdrawal remains lawful. Statutory retention and evidence duties may prevent immediate and complete erasure.
Right to object under Article 21 GDPR: on grounds relating to your particular situation, you may object to processing based on Article 6(1)(e) or (f). You may object to processing for direct marketing at any time without giving such grounds. You may also complain to a data protection supervisory authority, particularly at your habitual residence, workplace or the place of an alleged breach. The authority generally responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Postfach 10 29 32, 70025 Stuttgart; contact and complaints.
10. Information about other people and credit decisions
If you provide documents about another person, such as a co-owner or co-borrower, please limit them to the necessary information and ensure you are entitled to disclose them. Where we do not obtain personal data directly from the person concerned, sources may include customers, owners, brokers or financing partners involved in a requested matter, and permissible public sources. Duties to inform under Article 14 GDPR remain unaffected. Calculations on this website do not make a binding credit decision. Any required creditworthiness assessment or decision by a bank follows that institution’s procedures and privacy notice.
11. Property newsletter
If you subscribe to our property newsletter, we process your email address, selected language and region of interest, and the time, source and content of your consent. For abuse prevention and proof, the IP address at signup is stored only as a hash. Subscription becomes effective only after you confirm the link in an email (double opt-in). The legal basis for sending is your consent under Article 6(1)(a) GDPR.
We use Brevo for confirmation emails, recipient lists and newsletter delivery. The necessary contact and selection data is sent to Brevo. Opening and click measurements for future emails are anonymised in our Brevo account; we use them only as aggregate statistics and do not attribute them to individual subscribers. Section 7 applies to any transfers outside the EEA.
You can unsubscribe at any time using the link in each issue or withdraw consent using the contact details above. We then stop using your address for delivery and remove it from the mailing list. Evidence of consent or withdrawal may be retained separately for applicable statutory proof and limitation periods. Without confirmation, you will not receive the newsletter.