Privacy Policy

1. General Information and Mandatory Disclosures We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this Privacy Policy. When you use this website, various personal data is collected, i.e., data with which you can be personally identified. We would like to point out that data transmission over the Internet (e.g. when communicating by email) can have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Controller The responsible party for data processing on this website is: Dr. Thomas Ulsamer ImmobilienWerte Owner: Dr. Thomas Ulsamer Hegelallee 35, 14467 Potsdam Phone: +49 (0) 331 981 921 36 Email: [email protected]

General Information on the Legal Bases of Data Processing If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. In the case of explicit consent to the transfer of personal data to third countries, data processing is carried out on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device, data processing is additionally carried out on the basis of § 25(1) TTDSG. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation, on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Automated decision-making is not used on this website. Note on Data Transfers to the USA and Other Third Countries Among other things, we use tools from companies based in the USA or in other third countries that are not secure under data protection law. If these tools are active, your personal data may be transferred to these third countries and processed there. We would like to point out that a level of data protection comparable to that in the EU cannot be guaranteed in these countries. US companies are obliged to hand over personal data to security authorities without you, as the data subject, being able to take legal action against this. It can therefore not be ruled out that US authorities process, evaluate and permanently store your data located on US servers for surveillance purposes. Your Rights as a Data Subject

Right to Information, Deletion and Rectification: You have the right at any time to obtain free information about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or deletion of this data.

Right to Restriction of Processing: You have the right to request the restriction of the processing of your personal data.

Right to Data Portability: You have the right to have data that we process automatically handed over to you or to a third party in a common, machine-readable format.

Right to Lodge a Complaint with the Competent Supervisory Authority: You have the right to lodge a complaint with a supervisory authority: "State Commissioner for Data Protection and the Right to Inspect Files Brandenburg" (DSB Brandenburg), https://www.lda.brandenburg.de/lda/de/

Revocation of Your Consent to Data Processing: You can revoke consent that has already been given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.

Right to Object to Data Collection in Special Cases and to Direct Marketing (Art. 21 GDPR): If data processing is carried out on the basis of Art. 6(1)(e) or (f) GDPR, you have the right at any time, for reasons arising from your particular situation, to object to the processing of your personal data; this also applies to profiling based on these provisions. If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing serves the assertion, exercise or defense of legal claims (objection pursuant to Art. 21(1) GDPR). If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing (objection pursuant to Art. 21(2) GDPR). 2. Cookies

Our websites use so-called "cookies". Cookies are small text files and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted after your visit ends. Persistent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.

In some cases, cookies from third-party companies may also be stored on your device when you visit our site (third-party cookies). These enable us or you to use certain services of the third-party company (e.g., cookies for processing payment services).

Cookies serve various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g., the shopping cart function or the display of videos). Other cookies are used to evaluate user behavior or display advertising.

Cookies that are required for the execution of the electronic communication process, for the provision of certain functions you have requested (e.g., for the shopping cart function) or for the optimization of the website (e.g., cookies for measuring web audience) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimized provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TTDSG); consent can be revoked at any time.

You can set your browser to inform you about the setting of cookies and to allow cookies only on a case-by-case basis, to exclude the acceptance of cookies for specific cases or in general, and to activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.

Insofar as cookies are used by third-party companies or for analysis purposes, we will inform you separately about this within the scope of this Privacy Policy and, if necessary, request your consent.

3. Data Processing and Services on this Website

Hosting at IONOS: We host our website with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Email: [email protected], Privacy Policy: https://www.ionos.de/terms-gtc/datenschutzerklaerung

Data Processing: IP addresses are processed.

Legal Basis: The use is based on Art. 6(1)(f) GDPR, as we have a legitimate interest in the most reliable presentation of our website possible. If consent has been requested, processing is carried out on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDSG.

Data Processing Agreement: We have concluded a data processing agreement (DPA) with IONOS SE to ensure that personal data is only processed according to our instructions and in compliance with the GDPR.

DNS Services by IONOS: The domain thomas-ulsamer.com uses the IONOS nameserver for DNS queries. IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Email: [email protected], Privacy Policy: https://www.ionos.de/terms-gtc/datenschutzerklaerung

Data Processing: IP addresses are processed.

Legal Basis: The use is based on Art. 6(1)(f) GDPR, as we have a legitimate interest in the most reliable presentation of our website possible. If consent has been requested, processing is carried out on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDSG.

Data Processing Agreement: We have concluded a data processing agreement (DPA) with IONOS SE to ensure that personal data is only processed according to our instructions and in compliance with the GDPR.

This website uses the Cloudflare service. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter "Cloudflare").

Cloudflare offers a Content Delivery Network (CDN) with DNS services. Technically, the information transfer between your browser and our website is routed through the Cloudflare network to protect our website from attacks and to optimize loading times.

Data Processing: Cloudflare processes IP addresses, system and log data, and may use cookies or comparable technologies for recognition.

Legal Basis: The use is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most secure and efficient provision of our website possible.

The data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Further information can be found in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. Your information, e.g., names, addresses, contact details, message content and IP addresses are processed. We do not share this data without your consent.

Legal Basis: If the inquiry is related to the fulfillment of a contract or necessary for the implementation of pre-contractual measures: Art. 6(1)(b) GDPR. In all other cases: Our legitimate interest in the effective processing of inquiries (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR), if requested; consent can be revoked at any time.

Storage Duration: The data remains with us until you request deletion, revoke your consent, or the purpose for data storage no longer applies (e.g., after completion of processing). Mandatory legal provisions – in particular retention periods – remain unaffected.

If you contact us by email, telephone or fax, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of processing your request. We do not share this data without your consent.

Legal basis: If the inquiry is related to the fulfillment of a contract or necessary for the implementation of pre-contractual measures: Art. 6(1)(b) GDPR. In all other cases: Our legitimate interest in the effective processing of inquiries directed to us (Art. 6(1)(f) GDPR) or, if consent has been requested, Art. 6(1)(a) GDPR.

Storage duration: The data you send to us via contact inquiries will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

We use HubSpot for our Customer Relationship Management (CRM). The provider is HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA.

HubSpot enables us to manage customer inquiries, track interactions and conduct email marketing campaigns.

Data Processing: When using our website or contacting us, personal data such as name, email address, phone number, company and your inquiry are stored in HubSpot. In addition, usage data such as pages visited, interactions and technical data (IP address, browser type) may be collected.

Legal basis: Processing is carried out on the basis of Art. 6(1)(b) GDPR (contract fulfillment/pre-contractual measures), Art. 6(1)(f) GDPR (legitimate interest in efficient customer communication) or Art. 6(1)(a) GDPR (consent), if this has been requested. Consent can be revoked at any time.

Data processing agreement: We have concluded a Data Processing Agreement (DPA) with HubSpot. The data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Further information: https://legal.hubspot.com/de/privacy-policy

We use Microsoft 365 for email communication, scheduling, contact management and document processing. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Data Processing: When communicating by email and using Microsoft services, personal data such as name, email address, communication content and metadata are processed and stored on Microsoft servers.

Legal basis: Processing is carried out on the basis of Art. 6(1)(b) GDPR (contract fulfillment) and Art. 6(1)(f) GDPR (legitimate interest in efficient business communication).

Data processing agreement: We have concluded a Data Processing Agreement (DPA) with Microsoft. Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Further information: https://privacy.microsoft.com/de-de/privacystatement

For sending our emails and newsletters, we use the Brevo service (Brevo GmbH, Köpenicker Straße 126, 10179 Berlin). Brevo is a service with which, among other things, the sending of emails and newsletters can be organized and analysed.

The data you enter for the purpose of receiving emails (e.g., email address, name) is stored on Brevo servers in Germany and the EU.

Brevo uses this information to send and statistically evaluate emails on our behalf. For evaluation purposes, the sent emails contain so-called web beacons or tracking pixels. This allows us to determine whether an email was opened and which links were clicked. In addition, technical information is collected (e.g. time of retrieval, IP address, browser type and operating system).

Data processing is carried out on the basis of your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The lawfulness of data processing operations already carried out remains unaffected by the revocation. We have concluded a Data Processing Agreement (DPA) with Brevo pursuant to Art. 28 GDPR.

Further information can be found in Brevo's Privacy Policy at: https://www.brevo.com/de/legal/privacypolicy/

To support the handling of inquiries and our customer communication (e.g. summarising inquiries, drafting replies), we use the AI service Claude. The provider is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland.

Data Processing: The content of your inquiry, your contact details (e.g. name, email address, phone number) and our correspondence with you may be transmitted to Claude and processed there. We review the results; all decisions are made exclusively by a human. Anthropic does not use the data to train its AI models.

Legal basis: Art. 6(1)(b) GDPR, insofar as the processing serves to handle your inquiry or to take pre-contractual measures; otherwise Art. 6(1)(f) GDPR (legitimate interest in handling inquiries efficiently).

Data processing agreement: We have concluded a Data Processing Agreement (DPA) with Anthropic pursuant to Art. 28 GDPR. Processing may also be carried out by Anthropic, PBC in the USA; the data transfer is based on the Standard Contractual Clauses of the EU Commission.

Storage period: Anthropic stores the data only for as long as necessary to provide the service and deletes it in accordance with the contractually agreed periods.

Further information: https://www.anthropic.com/legal/privacy

The controller operates public profiles on Facebook and Instagram in order to communicate with users, inform them about offers and provide insights into our work. When you access and interact with our pages, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, as the provider of the platforms, processes, among other things, log and usage data (e.g. IP address, device and event data, cookie IDs or comparable online identifiers), profile data and the content of your interactions (e.g. comments, likes, messages). In this context, Meta provides us with aggregated statistics ("Page Insights") that provide information about reach and target groups.

Legal basis: For this Insights processing, we and Meta are jointly responsible pursuant to Art. 26 GDPR; Meta assumes primary responsibility for fulfilling your data subject rights with regard to Insights data. If you contact us via direct message or forms, we process the information you provide in order to handle your request and any follow-up questions. The processing serves public relations, communication and community management, reach measurement and target group analysis and, where applicable, legal enforcement and IT security. The legal bases are Art. 6(1)(a) GDPR (consent, e.g. for optional tracking/marketing functions of the platforms or for certain forms of communication), Art. 6(1)(b) GDPR (contract/initiation of a contract, insofar as your request is aimed at this) and Art. 6(1)(f) GDPR (legitimate interest in effective public presentation and interaction with users).

Recipients are Meta as platform provider (as an independent controller), internal departments and commissioned service providers (e.g. agencies/tools) and, where legally required, public authorities; in the case of public interactions, your content is also visible to other users. A transfer to third countries, in particular to the USA, may take place in the context of using the platforms; according to its own information, Meta relies on appropriate safeguards under data protection law for this (e.g. EU adequacy decision/relevant mechanisms and/or EU Standard Contractual Clauses) with supplementary measures, although a residual risk cannot be completely ruled out. We delete or anonymise personal content within our sphere as soon as the purpose no longer applies or you request deletion; storage and deletion periods on the platforms are controlled by Meta and are beyond our full control. The use of our social media offerings is voluntary; certain interactions are not possible without providing data or having an account. You can revoke consent at any time with effect for the future; you can also limit personalised advertising in your Facebook/Instagram account and ad settings and adjust cookie/tracking settings in your browser/device; in addition, you can assert your rights (access, rectification, erasure, restriction, objection, data portability, complaint to a supervisory authority) against us or Meta, with Meta being primarily responsible for Insights data.

Further information: https://www.facebook.com/privacy/policy/

We operate a company page on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

When you visit or interact with our LinkedIn page, LinkedIn processes, among other things, IP addresses, device information, browser type and information about your interactions. LinkedIn also provides us with anonymous statistics about the use of our page.

For this analytics processing, we and LinkedIn are jointly responsible pursuant to Art. 26 GDPR. LinkedIn assumes primary responsibility for fulfilling your data subject rights regarding analytics data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in effective public presentation).

Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Further information: https://de.linkedin.com/legal/privacy-policy 5. Analytics Tools and Advertising

We use Google Ads, an online advertising service of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when users enter certain search terms on Google (keyword targeting). In addition, targeted advertisements can be displayed on the basis of user data available to Google (e.g. location data and interests) (audience targeting).

Data Processing: Google uses cookies and processes IP addresses and usage data. We can evaluate the success of individual advertising measures using conversion tracking.

Legal basis: Use is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. Consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Further information: https://policies.google.com/privacy?hl=de

This website uses Google Ads Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google Ads Conversion Tracking, we can determine whether the user has performed certain actions (e.g., submitting a contact form). This allows us to evaluate the success rates of our advertising measures.

Data Processing: When you click on an advertisement placed by Google, a cookie is set for conversion tracking. These cookies expire after 30 days and are not used for personal identification.

Legal basis: Use is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. Consent can be revoked at any time.

Further information: https://policies.google.com/privacy?hl=de

We use the Meta Pixel (formerly Facebook Pixel). The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

The Meta Pixel enables us to track the behaviour of users after they have been redirected to our website by clicking on a Facebook or Instagram advertisement (conversion tracking). In addition, the Meta Pixel allows us to create so-called "Custom Audiences" in order to display targeted advertising on Facebook and Instagram.

Data Processing: The Meta Pixel processes, among other things, IP addresses, web browser information, page views, referrer URL and device-related data.

Legal basis: Use is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. Consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Further information: https://www.facebook.com/privacy/policy/ You can deactivate data collection by the Meta Pixel in your Facebook ad settings: https://www.facebook.com/adpreferences/ad_settings

This site uses so-called Web Fonts provided by Google for a uniform display of fonts. When you access a page, your browser loads the required Web Fonts into your browser cache to display texts and fonts correctly.

For this purpose, the browser you are using must connect to Google's servers. This enables Google to learn that this website was accessed via your IP address. The use of Google Web Fonts is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on its website. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDSG; consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses.

Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://policies.google.com/privacy?hl=en

This website embeds videos from YouTube. The operator of the website is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our web pages on which YouTube is embedded, a connection to YouTube's servers is established. The YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

Data Processing: YouTube processes, among other things, IP addresses, device information, pages visited and – if you are logged in – information about your YouTube/Google account.

The use of YouTube is in the interest of an appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDSG; consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses.

Further information on the handling of user data can be found in YouTube's privacy policy: https://policies.google.com/privacy?hl=en