Privacy policy

This English version is a courtesy translation. Only the German version is legally binding: Datenschutzerklärung.

Responsibility for data processing

Nordfinanz GmbH, Alt-Vinnhorst 18, 30419 Hannover, represented by the Managing Director Christian Gülke, phone 0511 97820030, email info@nordfinanz.de (hereinafter “we”), as the operator of the website www.nordfinanz.de, is the controller within the meaning of Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR). If you have any questions, please contact info@nordfinanz.de.

Data protection officer

Under Art. 37 GDPR in conjunction with Section 38 of the German Federal Data Protection Act (BDSG), we are not obliged to appoint a data protection officer. You are of course welcome to contact us at any time using the contact details above with questions about data protection and to exercise the rights set out below.

Data subject rights

Your rights as a data subject

As a data subject, you have the following rights towards us with regard to your personal data. You have:

A right of access, including to the categories of data processed, the purposes of processing, the storage period and any recipients, under Art. 15 GDPR and Section 34 BDSG.
A right to rectification or erasure of inaccurate or incomplete data, under Art. 16 and 17 GDPR and Section 35 BDSG.
Under the conditions of Art. 18 GDPR or Section 35 (1) sentence 2 BDSG, a right to restriction of processing.
A right to object to processing under Art. 21 (1) GDPR, insofar as the data processing was based on a legitimate interest.
A right to withdraw consent with effect for the future under Art. 7 (3) GDPR.
A right to data portability in a common format under Art. 20 GDPR.

Under Art. 22 GDPR, you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. This also includes profiling within the meaning of Art. 4 No. 4 GDPR.

You also have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority about our processing of your personal data, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

Procedure

If you assert your rights under the GDPR and the BDSG towards us, we will process the data you send us in doing so in order to fulfil your claim. We then store the data you sent us and the data we sent you in return for documentation purposes until the limitation period for administrative offences has expired (3 years). The legal basis for storing the data is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in data processing). The legitimate interest arises from our obligation to comply with your request and our need to be able to exonerate ourselves in possible fine proceedings by proving that we have properly complied with your request.

Data protection measures

We protect our website and other systems, and thus also your data, through technical and organisational measures against loss, destruction, access, alteration or dissemination by unauthorised persons. In particular, your personal data is transmitted over the internet in encrypted form. For this we use the TLS (Transport Layer Security) encryption system.

However, the transmission of information over the internet is never completely secure, which is why we cannot guarantee 100% security for data transmitted from our website.

Data processing arrangements

Sources and categories of personal data

We process your personal data insofar as it is necessary for establishing, defining the content of or amending a contractual relationship between us and you (master data). Master data may in particular include: name, form of address, contact details (postal address, phone, email address), date of birth, etc.

We also process your usage data. Usage data is data generated by your behaviour when using our website and services, in particular your IP address, the start and end of your visit to our website and information about which content you have accessed on our website.

We collect this data either directly from you (e.g. through your visit to the website) or, insofar as permitted by data protection law, from third parties or publicly accessible sources (e.g. commercial and association registers, press, media, internet).

Data transfers to third countries outside the EU

All information we receive from or about you is generally processed on servers within the European Union. Your data is only transferred to or processed in third countries without your express consent if this is provided for or permitted by law, if an adequate level of data protection is ensured in the third country, or if contractual obligations exist through so-called EU standard data protection clauses.

With regard to data transfers to the USA, the European Commission has adopted an adequacy decision called the EU-U.S. Data Privacy Framework, which ensures an adequate level of protection for the transfer of personal data by companies participating in the framework. Where we use services that transfer personal data to the USA, the description of the respective service states whether the company is certified under the EU-U.S. Data Privacy Framework.

Disclosure of data, processing on behalf

We never disclose your personal data to third parties without authorisation. We may, however, disclose your data to third parties in particular if you have consented to the disclosure, if the disclosure is necessary to fulfil our legal obligations, or if we are entitled or obliged to disclose data on the basis of statutory provisions or orders by authorities or courts. This may in particular involve providing information for the purposes of criminal prosecution, averting danger or enforcing intellectual property rights.

We may disclose the personal data collected from you to third parties in particular in the course of contract processing, for example to credit institutions, insurers or other product partners as part of a brokerage you have requested, insofar as this is necessary to perform the contract. The individual service providers and further information can be found below in the section “Third-party services”.

In some circumstances we also transfer your data to external service providers who process data on our behalf and according to our instructions (processors) in order to simplify or relieve our own data processing. Every processor is bound by a contract in accordance with Art. 28 GDPR. This means in particular that the processor must provide sufficient guarantees that appropriate technical and organisational measures are implemented in such a way that the processing complies with the requirements of the GDPR and that the protection of your rights as a data subject is ensured. Despite the use of processors, we remain the controller of the processing of your personal data within the meaning of data protection law.

Purpose of data processing

We generally use the data only for the purpose for which it was collected from you. We may further process the data for another purpose if that other purpose is compatible with the original purpose (Art. 5 (1) lit. b, Art. 6 (4) GDPR).

Storage period

Unless stated otherwise in individual cases, we store data collected from you only for as long as is necessary for the respective purpose, unless statutory retention obligations prevent deletion, e.g. under commercial or tax law.

Individual processing activities

Below we would like to set out as transparently as possible which of your data we process, on what occasion, on what basis and for what purpose.

Server log files

Every time a web page is accessed and data is retrieved from a server, general information is automatically transmitted to the providing server. This data transmission takes place automatically and is a fundamental part of communication between devices on the internet.

The data transmitted by default includes the following information, among other things: your IP address, product and version information about the browser and operating system used (user agent), the website from which you accessed ours (referrer), and the date and time of the request (timestamp). The HTTP status and the amount of data transferred in the course of this request are also recorded.

This information is logged by the server, placed in a table and stored there for a short time (server log files). By analysing these log files, we can identify and then remedy website errors, determine the website’s load at certain times and make adjustments or improvements on this basis, and ensure server security by being able to trace from which IP address attacks on our server were carried out.

Your IP address is stored only for the time you use the website and is then deleted immediately or partially anonymised by truncation. The remaining data is stored for a limited period (usually 7 days).

The legal basis for the use of server log files is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in data processing). The legitimate interest arises from the need to operate and maintain our website, as explained above. You may object to the processing of your data based on our legitimate interest at any time under the conditions of Art. 21 GDPR. Please use the contact details given in the legal notice for this purpose. However, we point out in advance that the processing of your data in server log files is compelling within the meaning of Art. 21 (1) GDPR, as the website could otherwise not be operated at all.

Cookies and web storage

To improve user-friendliness on our website, we use so-called “cookies” and your browser’s “web storage”.

Cookies

What cookies are

Put very simply, a cookie is a small text file that stores data about websites visited. Cookies can be used in many ways. For example, they can store a kind of “user profile”, i.e. things like your preferred language and other page settings that our website needs in order to offer you certain services. The cookie file is stored on your device and can also help to recognise you when you return to our website. In some circumstances, cookies can also give us information about your preferred activities on our website, allowing us to align our website with your individual interests or even increase the speed of navigation on our website.

How you can avoid cookies

You can manually delete cookies at any time in your browser’s security settings. You can also prevent cookies from being stored from the outset by adjusting your browser settings accordingly. Please note, however, that you may then not be able to use all functions of our website in full, or that errors may occur in the display and use of the website.

Third-party cookies

It is possible that third parties with whose help we design and operate our site, in particular through embedded content and calculators (see below in the section “Third-party services”), independently store their own cookies on your device. If you wish to accept only our own cookies but not those of these third parties, you can prevent them from being stored using the browser setting “Block third-party cookies”.

Consent management (cookie banner)

When you first visit our website, we ask you via a notice (cookie banner) whether you agree to the use of non-essential cookies and services. The cookie banner is our own technical solution, located entirely on our web server. No third-party service is used for this and no data is transmitted to third parties. We store your selection exclusively locally in your browser (cookie or web storage) so that we can take your decision into account on further page views and do not have to ask you again each time. You can call up and change your settings at any time via the corresponding link in the footer of our website.

Which cookies are used

Essential cookies: The “Essential” category covers all data storage that is strictly necessary to provide the digital service expressly requested by the user. This means these cookies are technically indispensable for us to be able to operate our website in compliance with the law. This category includes in particular the storage of the selection you made in the cookie banner.

Analytics: The “Analytics” category covers cookies from the analytics service Google Analytics, which we use to evaluate the use of our website. If you accept this category, pseudonymous identifiers are assigned to your browser and usage data is transmitted to Google. Further information can be found below under “Third-party services”, “Audience measurement”.

Functional: The “Functional” category covers cookies set by external services such as Google Maps or the WhoFinance rating seal. If you accept this category, automatically collected data, e.g. your IP address, is transferred to the providers of these services. You can read which services we use in detail further below under “Third-party services”, “Media services”.

Marketing: The “Marketing” category covers cookies from services that show content relevant to your interests. We do not currently use any such services.

Legal basis

The legal basis for the use of cookies that are strictly necessary for the website to function (e.g. storing your cookie settings) is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in data processing) and Section 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG; strict necessity to provide a digital service expressly requested by the user). The legitimate interest arises from our need to offer you a working website. Cookies are necessary for this because they are an integral part of current internet technology and many functions of current websites would not be available without them. We therefore need cookies to be able to provide the website to you at your request.

You may object to the processing of your data based on our legitimate interest at any time under the conditions of Art. 21 GDPR. Please use the contact details given in the legal notice for this purpose. However, we point out that the processing of your data in certain cookies is compelling within the meaning of Art. 21 (1) GDPR, as the website could otherwise not be operated at all and we have no technical means of preventing cookies from being set on particular individual devices. You may, however, be able to do this yourself in your browser. For more information, please consult your browser’s instructions.

The legal basis for the use of cookies that are not strictly necessary for the website to function is Art. 6 (1) sentence 1 lit. a GDPR (consent of the data subject) and Section 25 (1) TDDDG. When you first visit the website, we ask for your consent to the use of non-essential cookies via the cookie banner. You can withdraw your consent at any time with effect for the future by calling up the cookie banner again and changing the settings you made.

Web storage

What web storage is

Web storage is a technology for web applications that stores data in a web browser. Put simply, web storage can be seen as a further development of cookies, but it differs from them in some respects. Unlike cookies, which both server and client can access, web storage is controlled entirely by the client. This means that data is not transmitted to the server each time the website is accessed. Access takes place exclusively locally via scripts on the website. In concrete terms, this means that third parties cannot access the stored information via the website. Only you and we can access the locally stored data.

Legal basis

The legal basis for the use of web storage that is strictly necessary for the website to function is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in data processing) and Section 25 (2) No. 2 TDDDG (strict necessity to provide a digital service expressly requested by the user). The legitimate interest arises from our need to offer you a working website. Web storage is necessary for this because it is an integral part of current internet technology and many functions of current websites would not be available without it. We therefore need web storage to be able to provide the website to you at your request. You may object to the processing of your data based on our legitimate interest at any time under the conditions of Art. 21 GDPR. Please use the contact details given in the legal notice for this purpose. However, we point out that the processing of your data in web storage may be compelling within the meaning of Art. 21 (1) GDPR, as the website could otherwise not be operated at all and we have no technical means of preventing its use on particular individual devices. You may, however, be able to do this yourself in your browser. For more information, please consult your browser’s instructions.

The legal basis for the use of web storage that is not strictly necessary for the website to function is Art. 6 (1) sentence 1 lit. a GDPR (consent of the data subject) and Section 25 (1) TDDDG. When you first visit the website, we ask for your consent to its use via the cookie banner. You can withdraw your consent at any time with effect for the future by calling up the cookie banner again and changing the settings you made.

Contacting us

Our website offers ways to contact us directly, in particular by email, phone or via our contact form. We process the data you send us exclusively until the respective purpose of your enquiry has been achieved, unless statutory retention periods prevent this. If the purpose of your enquiry is to assert data subject rights, the statements in the section “Your rights as a data subject” apply. We process all data you provide when contacting us, e.g. your name, email address, phone number and the content of your message.

If you use our contact form, your input is forwarded to us by email from our web server. It is sent via the mail servers of our hosting provider (see below “Third-party services”, “Hosting”).

The legal basis for the use of the data you send us when contacting us in the context of contractual or pre-contractual relationships or for answering (pre-)contractual enquiries is Art. 6 (1) sentence 1 lit. b GDPR (data processing to perform a contract). The legal basis for processing the data you send us when contacting us in cases other than for contractual or pre-contractual purposes or enquiries is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in data processing). Our legitimate interest in the processing arises from our interest in answering enquiries and maintaining user relationships. You may object to the processing of your data based on our legitimate interest at any time under the conditions of Art. 21 GDPR. Please use the contact details given in the legal notice for this purpose.

Third-party services

To simplify our data processing and to extend the functionality of our website, we use services and resources from third parties, for example external content, software or other external service providers (services). In doing so, personal data may also be transmitted to the service provider. To protect your data, we have, where necessary, contractually obliged the service providers under Art. 28 GDPR to process your data only according to our instructions.

We expressly point out that we are generally only responsible within the meaning of the GDPR for the collection of data and its transmission by the service, but not for any subsequent processing by the respective service provider.

In detail, we use the following services:

Hosting

IONOS

Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS provides the server infrastructure on which our website runs and operates the mail servers through which, among other things, messages from our contact form are sent to us. Each time our website is accessed, the data described above under “Server log files” is processed on IONOS’s servers. The servers are located in Germany. We have concluded a data processing agreement with the provider under Art. 28 GDPR to ensure that it processes your data only according to our instructions. More information on how user data is handled can be found in the IONOS privacy policy at www.ionos.de.

The legal basis for the use of IONOS and the associated processing of your data is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in data processing). The legitimate interest arises from our need for a technically flawless, secure and fast presentation of our website. You may object to the processing of your data based on our legitimate interest at any time under the conditions of Art. 21 GDPR. Please use the contact details given in the legal notice for this purpose. However, we point out that the processing of your data by our hosting provider is compelling within the meaning of Art. 21 (1) GDPR, as the website could otherwise not be operated at all.

Fonts

On our website we use fonts (web fonts) stored locally on our own web server. When you access our website, no connection is established to the servers of font providers (e.g. Google Fonts). No data is transmitted to third parties in this respect. Only the data described above under “Server log files” arises on our web server.

Videos

Videos on our website are played using our own, self-developed video player. The video files are located on our own web server at our hosting provider. When the videos are played, no connection is established to external video platforms (e.g. YouTube or Vimeo). No data is transmitted to third parties in this respect. Only the data described above under “Server log files” arises on our web server.

Audience measurement

We use a service that records data from website visitors and provides it to us for audience measurement. We use this data for the usage-oriented improvement of our website, services and offers. In particular, the following information on visitor behaviour may be collected: your IP address, product and version information about the browser and operating system used (user agent), the website from which you accessed ours (referrer), the date and time of the request and possibly your internet service provider, approximate origin (country and city), language, clicks on content and viewing time.

Google Analytics

Our website uses the web analytics service “Google Analytics” (Google Analytics 4) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is only loaded once you have consented to the “Analytics” category in the cookie banner.

Google Analytics uses cookies (in particular the cookies “_ga” and “_ga_[ID]”, each with a storage period of 2 years) and comparable technologies to recognise your browser and assign you a pseudonymous user identifier. The information generated by the cookies about your use of our website is transmitted to Google servers and stored there. In particular, the following is recorded: pages accessed, length of stay, interactions (e.g. clicks, scroll depth), the website from which you accessed ours (referrer), device type, browser and operating system, screen resolution, language setting and your approximate origin (country, region, city), which is derived from your IP address. Google Analytics 4 does not store or log your full IP address; the approximate origin is derived on servers within the EU, after which the IP address is discarded.

Google uses this information on our behalf to evaluate your use of our website, to compile reports on website activity and to provide us with further services related to website and internet use. The user and event data stored in Google Analytics is automatically deleted after 14 months. We have concluded a data processing agreement with Google under Art. 28 GDPR.

In the course of using Google Analytics, personal data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. In addition, Google has concluded standard contractual clauses based on the EU Commission’s template.

The legal basis for the use of Google Analytics is Art. 6 (1) sentence 1 lit. a GDPR (consent of the data subject) and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future by calling up the cookie banner again and changing the settings you made. You can also prevent recording by Google Analytics by installing the browser add-on provided by Google: https://tools.google.com/dlpage/gaoptout.

More information on how user data is handled by Google Analytics can be found in Google’s privacy policy: https://policies.google.com/privacy.

Media services

We use certain services to fill and supplement our website with digital content. For this we use the embedding functions of external platforms. When content is retrieved from the provider’s server, data is transmitted to the provider and usually stored there, e.g. your IP address, product and version information about the browser and operating system used (user agent), the website from which you accessed ours (referrer), the date and time of the request and possibly your internet service provider. For more information, see above under “Server log files”.

We use:

Google Maps

Our website uses the map service “Google Maps” of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Maps is used to show you our location on an interactive map and to make it easier for you to find us. The map is only loaded once you have consented to the “Functional” category in the cookie banner. Until then, you will only see a placeholder in place of the map. Alternatively, you can release the map individually using the “Load map” button; this release is also stored only locally in your browser and is reset via the “Cookie settings” link in the footer.

When you load the map, a connection to Google’s servers is established. Information such as your IP address, product and version information about the browser and operating system used (user agent), the website from which you accessed ours (referrer), the date and time of the request and your interactions with the map is transmitted to Google. Google may also set its own cookies. If you have a Google user account and are logged in to it on the same device, Google may assign your visit to our website to your user account. If you wish to avoid this, you can log out of your user account before loading the map.

In the course of using Google Maps, personal data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework.

The legal basis for the use of Google Maps is Art. 6 (1) sentence 1 lit. a GDPR (consent of the data subject) and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future by calling up the cookie banner again and changing the settings you made.

More information on how user data is handled can be found in Google’s privacy policy: https://policies.google.com/privacy and in the terms of use for Google Maps: https://www.google.com/intl/de_de/help/terms_maps/.

WhoFinance rating seal

On our home page and on the “About us” page we embed a rating seal from WhoFinance GmbH, Teerofendamm 1, 14532 Kleinmachnow, Germany (“WhoFinance”), which shows client reviews of our adviser. The seal is only loaded once you have consented to the “Functional” category in the cookie banner or released it individually using the “Load rating seal” button. Until then, you will only see a placeholder in place of the seal.

When you load the seal, a connection to WhoFinance’s servers is established. Information such as your IP address, product and version information about the browser and operating system used (user agent), the website from which you accessed ours (referrer) and the date and time of the request is transmitted to WhoFinance. WhoFinance may also set its own cookies.

The legal basis for embedding the seal is Art. 6 (1) sentence 1 lit. a GDPR (consent of the data subject) and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future by calling up the cookie banner again via the “Cookie settings” link in the footer and changing the settings you made.

More information on how user data is handled can be found in WhoFinance’s privacy policy: https://www.whofinance.de/datenschutz/.

Other services

Europace calculator

Our website provides you with a terms calculator from Europace AG, Heidestraße 8, 10557 Berlin, Germany (“Europace”). This calculator gives you a rough overview of the financing prospects for your ideal property and your maximum financing options. The calculator is loaded directly when the respective subpage is accessed. For this purpose, your input in the calculator, your IP address, the page you accessed, the time of access and your browser configuration are transferred to Europace. Europace may set its own cookies when providing the calculator, which are necessary for the calculator to function.

We are the controller under Art. 4 No. 7 GDPR for the transfer of this data to Europace AG, which is technically indispensable for providing the service on our website. The legal basis for the transfer of your data to Europace that is indispensable for providing the service is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in data processing) and Section 25 (2) No. 2 TDDDG. The legitimate interest arises from our interest in providing you with an attractive and user-friendly website in terms of content and appearance, and in offering you a simple and transparent way to calculate property financing and budgets. You may object to the processing of your data based on our legitimate interest at any time under the conditions of Art. 21 GDPR. Please use the contact details given in the legal notice for this purpose.

Europace AG further processes the transferred data on its own responsibility and for its own purposes. We generally have no influence on this processing. Europace AG is therefore the controller under Art. 4 No. 7 GDPR for this further data processing. If you wish to send an enquiry to Europace AG via the calculator or the contact form it contains, you must give your consent to the processing of your data under Art. 6 (1) sentence 1 lit. a GDPR. You can withdraw this consent at any time with effect for the future towards Europace AG. Further information can be found in the privacy notices within the calculator and in Europace’s privacy notices at: https://europace.de/datenschutzerklaerung-2021.

Property search (meineimmosuche.de)

Our website embeds a property search widget from Ampr Software GmbH, Heidestraße 8, 10557 Berlin, Germany (“Ampr”), which is provided via the platform meineimmosuche.de. You can use this widget to search for property listings and have listings displayed. The widget is loaded as a so-called iFrame directly from Ampr’s servers when the respective subpage is accessed. In the process, your IP address, product and version information about the browser and operating system used (user agent), the page you accessed and the time of access are transferred to Ampr. If you actively use the widget, your search entries and interactions are also transmitted to Ampr. Ampr may set its own cookies when providing the widget, which are necessary for the widget to function.

We are the controller under Art. 4 No. 7 GDPR for the transfer of the data that is technically indispensable for providing the widget on our website. The legal basis for this is Art. 6 (1) sentence 1 lit. f GDPR (legitimate interest in data processing) and Section 25 (2) No. 2 TDDDG. The legitimate interest arises from our interest in providing you with a user-friendly website and offering you a simple way to search for suitable property listings. You may object to the processing of your data based on our legitimate interest at any time under the conditions of Art. 21 GDPR. Please use the contact details given in the legal notice for this purpose.

Ampr Software GmbH further processes the transferred data on its own responsibility and for its own purposes. We generally have no influence on this processing. Ampr Software GmbH is therefore the controller under Art. 4 No. 7 GDPR for this further data processing. If you wish to send an enquiry about a property listing via the widget, you must give your consent to the processing of your data under Art. 6 (1) sentence 1 lit. a GDPR. You can withdraw this consent at any time with effect for the future towards Ampr Software GmbH. Further information can be found in the privacy notices within the widget and in the provider’s privacy notices on meineimmosuche.de.

Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to reflect changes to our services, e.g. when introducing new services. The current privacy policy then applies to your next visit.

As of: October 2026