Privacy statement

As at: 10 October 2026 · Version 1

At a glance

This website is deliberately built to collect as little data as possible. It consists of files generated in advance and delivered by a single server in Germany. No third-party services are embedded.

When a page is opened, only the HTML document with a few lines of JavaScript for the menu, the filter and the image display, one stylesheet, up to three font files and the images of that page are transmitted. All of it comes from the same server. The JavaScript runs solely in your browser and sends nothing back.

The only exceptions are the contact form and the acquisitions form: there a script fetches a security check from our own server, and your entries are transmitted when you send the form. The details are given below in the section “Contacting us”.

• no audience measurement in the browser, no cookies for it, no profiling — only an aggregated access statistic that the server compiles from its access log with truncated IP addresses (details below)
• no maps, no embedded videos, no social network buttons
• no fonts from third-party servers — they are held in our own directory
• no advertising networks, no disclosure to third parties for advertising purposes
• no cookies; nothing is stored on your device
• no transfer to countries outside the European Union when the pages are opened; for messages sent through the forms or by e-mail, see the section “Transfers to third countries”

Controller

The controller for the processing of personal data within the meaning of Art. 4(7) GDPR is:

Office Köln

Data protection officer

Whether a data protection officer has to be appointed is currently being examined. As long as no appointment has been published, please address data protection enquiries to the postal address or the e-mail address given above. The matter is listed as an open point at the end of this statement.

What this statement covers

This statement applies to the website at the internet address given above. Personal data are all details relating to an identified or identifiable natural person (Art. 4(1) GDPR) — this includes in particular the IP address of your connection.

It does not apply to websites of other providers linked from here. Their content and their data processing are the sole responsibility of the respective provider.

Opening the pages, hosting and server logs

The website is operated on a rented server. The provider, and thus the processor within the meaning of Art. 28 GDPR, is:

The server is located in the Nuremberg data centre in Germany. It is named “welling-sites”, runs on Debian 13 and delivers the pages through the Caddy web server. The data arising when the pages are opened do not leave the Federal Republic of Germany in the process. For messages from the forms, the section “Transfers to third countries” also applies.

Connection data

As with every request on the internet, the delivering server has to process technically necessary connection data. These regularly include:

• the IP address of the requesting connection
• the time and time zone of the request
• the address requested and the transfer protocol used
• the server’s response (status code) and the volume of data transferred
• the identifier of the browser and the operating system (user agent)
• the page from which the request was made (referrer), where the browser transmits it

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide the website free of technical faults, to detect malfunctions and to defend the server against attacks. These data are not combined with other sources, and no usage profile is created from them.

The web server keeps two logs (configuration as of 10 October 2026). First, an access log with a truncated IP address (IPv4 to the /24 network, IPv6 to the /32 network). Second, a defence log with the full IP address, which is evaluated solely to detect and fend off attacks and abuse (for example to block an attacking address manually). The server starts a new file every hour for the defence log and every day for the access log; an automatic hourly run deletes, from the completed files, access-log entries after seven days at the latest and defence-log entries after 48 hours at the latest. Excepted are entries secured separately to investigate a specific case of abuse; they are deleted as soon as they are no longer needed for that purpose, at the latest six months after the incident. Cookies and login data are not stored in either log. Calls of the form service’s confirmation link are not recorded in either log.

Access statistic: from the access log (IP address already truncated), a program on the same server (GoAccess) compiles an aggregated statistic — number of requests and visits per page and day, browser and operating-system family, referring pages, response codes and truncated network addresses. No cookies are set and nothing is stored on or read from your device; the statistic is not combined with other data and can only be viewed internally with a password. The aggregated values are kept for 400 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to understand the use of the site in aggregated form and to improve it.

Processing on our behalf

A data processing agreement under Art. 28 GDPR is to be concluded with the server provider, in so far as this has not already happened. Its conclusion is listed as an open point at the end of this statement. This statement expressly does not assert that the agreement is already in place.

Cookies, comparable techniques and your consent

Under section 25(1) TDDDG, storing information on your end device and accessing information stored there is permitted only with your consent. Strictly necessary operations are excepted under section 25(2) TDDDG.

At present neither takes place: this website sets no cookies, stores nothing in your browser and reads nothing from your browser. Consent is therefore not required, and none is requested.

The website nevertheless carries a complete consent management system. It is built in but switched off: it appears only at the moment a service actually requiring consent is set up. Showing a consent banner when there is nothing to consent to would be misleading — it would assert data processing that does not take place.

As soon as such a service is set up, the following applies: you are asked before anything is loaded or stored. Nothing is pre-ticked. “Necessary only” is just as easy to reach as “Accept all”. Without your decision, only what is strictly necessary happens.

The categories in detail

Strictly necessary

These operations are required for the pages to be delivered and used at all. They cannot be switched off, because without them no page could be opened. Under section 25(2) TDDDG no consent is required for them.

• Delivery of the pages
  The web server has to deliver the requested page and handle the connection. Nothing is stored on your device for this; only connection data arise on the server.
  Art. 6(1)(f) GDPR (legitimate interest)
• Record of your privacy settings
  Records which categories you have allowed or refused, so that you are not asked again on every visit and so that we can demonstrate the decision (Art. 7(1) GDPR). The entry is only created once a processing operation requiring consent has been set up and you have made a choice.
  Art. 6(1)(c) GDPR (legal obligation)

Statistics

Audience measurement: records anonymously or pseudonymously which pages are opened how often, how long visitors stay and which route they arrive by. This serves solely to improve the site. Without your consent nothing is measured in your browser.

No audience measurement in the browser is currently set up. For the server’s aggregated access statistic (without cookies) see the privacy policy.

External media

Content loaded from third-party servers — maps, videos, fonts. When it loads, the third-party server learns your IP address and may set its own cookies. Without your consent nothing is loaded; a notice with a button appears in its place instead.

No content from third-party servers is currently embedded.

Marketing

Advertising and measuring the success of advertisements, where applicable across several websites. Without your consent none of this takes place.

No advertising service is currently set up.

How your decision is recorded

Your decision is stored solely in your browser, in what is called “local storage” and not as a cookie. The reason: a cookie would be sent to the server with every single request — including every image and every font file — and would be visible in the server logs. Yet the server does not need to know your decision at all, because the site is static. The local storage entry never leaves your device. This is the option that collects the least data (Art. 5(1)(c) GDPR).

What is recorded is the time of your decision, the categories chosen, the version number of the consent text and a fingerprint of the list of services. This allows us to demonstrate the consent (Art. 7(1) GDPR). If the list of services changes, the fingerprint no longer matches; the earlier consent then lapses and you are asked again. Consent once given is therefore never silently carried over to a new service.

The entry does not expire by itself. You can delete it at any time through your browser settings; you will then be asked again on your next visit.

• welling-immo.einwilligung (localStorage) — time, chosen categories, version number and fingerprint of the list of services. until you delete it or change your choice; it does not expire by itself and becomes invalid whenever the list of services changes.

Withdrawal

At present there is nothing to withdraw: no consent is requested and none is given. For the same reason there is currently no “Cookie settings” link at the foot of the pages — it would lead nowhere. As soon as consent is obtained, that link appears on every page; withdrawing is then just as easy as giving consent (Art. 7(3) GDPR) and takes effect for the future, without affecting the lawfulness of processing carried out until then.

Contacting us

Contact form and acquisitions form

How it works.

There is a form on the contact page and on the acquisitions page. The contact form asks for name, e-mail address and message; the acquisitions form additionally for company, telephone, property and location, type of use, floor area and vacancy. Name, e-mail address and message are mandatory, and in the acquisitions form also property and location; all other details are voluntary.

When you send the form, your details are transmitted in encrypted form to a form service of our own, which we operate ourselves on the server named above at Hetzner Online GmbH in Germany. No external form or mailing service is used for this.

Security check: before sending, your browser solves a small computational task in the background (ALTCHA). Both the task and its verification come from our own form service; no third-party provider is involved, and no cookies are set for this. The form therefore cannot be sent without JavaScript — writing to us by e-mail remains open to you at any time.

Abuse prevention: the form service limits the number of submissions per connection. For this purpose it processes, when the security check is fetched, when you send and when you confirm, the IP address of your connection (for IPv6, the /64 network) in working memory for at most about one hour. In addition, it sends no more than one confirmation e-mail to the same e-mail address (a “+suffix”, and dots with Gmail, count as the same address) within 24 hours; for this it keeps, for about 24 hours, only a pseudonym of the address — a check value formed with a secret key — in working memory and on the server; without this key the address cannot be determined from it. Its log lines contain no message text; the e-mail address appears there only in shortened form, and the IP address only truncated — to the /24 network for IPv4, to the /64 network for IPv6. These logs are kept for 14 days; older entries are deleted. Excepted are entries that are secured separately to investigate a specific case of abuse (Art. 6(1)(f) GDPR); they are deleted as soon as they are no longer needed for that purpose, at the latest six months after the incident.

Confirmation: the form service stores your form entries on the server — without your IP address — and as a rule sends a confirmation link by e-mail to the address you gave. This e-mail is sent from our mailbox info@welling-immo.com. The link opens a page; only your click on “Confirm now” passes the message on to us (merely opening the link, for instance by a virus scanner, is not enough). The interim storage is deleted as soon as you confirm; if you do not confirm, it is deleted automatically after about two hours. In exceptional cases the service delivers the message directly, marked as unconfirmed, without a confirmation step — when the quota for confirmation e-mails (per hour or day) is used up, when a confirmation e-mail was already sent to the same address within 24 hours, or when sending it fails; you then receive no further confirmation e-mail. In all of these cases the feedback in the form is the same as in the normal case, so that nobody can find out whether an address has already been used or how busy the service is; your message has nevertheless been received.

Delivery: after your confirmation — or immediately in the case of direct delivery — the message is delivered as an e-mail through Microsoft 365 (Exchange Online) in the company’s own tenant of Anton Welling Nachf. Oliver Welling e.K.: enquiries from the contact form to info@welling-immo.com, enquiries from the acquisitions form to ankauf@welling-immo.com. Microsoft acts as processor in this respect. The internal hand-over e-mail contains your form entries, but neither your IP address nor the network of your connection. On where Microsoft stores the data and on possible third-country aspects, see the section “Transfers to third countries”.

Purpose, legal basis and retention.

By ticking the box below the form you confirm that you have read this privacy information. It is not consent within the meaning of Art. 6(1)(a) GDPR; the processing is based on the legal grounds stated below.

• Purpose: handling and answering your enquiry; in addition, protecting the form and our mailboxes against abuse
• Legal basis for handling the enquiry: Art. 6(1)(b) GDPR where your enquiry concerns a contract or its initiation; in all other cases Art. 6(1)(f) GDPR, our legitimate interest being to answer enquiries
• Legal basis for the confirmation e-mail, the security check, the rate limiting (including the limit of one confirmation e-mail per address and day) and the logs: Art. 6(1)(f) GDPR, our legitimate interest being to protect the form and our mailboxes against automated abuse and to make sure the address given really belongs to the sender
• Mandatory details: name, e-mail address and message, and in the acquisitions form also property and location; without them we cannot reply
• Retention: interim storage on the form service until you confirm, about two hours; pseudonym of the e-mail address for limiting confirmation e-mails about 24 hours; logs of the form service 14 days; automatic replies to confirmation e-mails (such as non-delivery reports) arrive in our mailbox info@ and are deleted there promptly, like other automatically generated submissions; in our mailbox, submissions that turn out to be automatically generated spam are deleted promptly, all others are kept for as long as is necessary to deal with your enquiry, deletion thereafter, unless statutory retention obligations apply (for example section 257 HGB, section 147 AO)
• Recipients: ankauf@welling-immo.com, info@welling-immo.com

E-mail, telephone and post

If you send us an e-mail, call us or write to us, we process your details in order to deal with your matter. The legal basis is Art. 6(1)(b) GDPR for contract-related matters, otherwise Art. 6(1)(f) GDPR.

Our mailboxes are operated in the company’s own Microsoft 365 tenant of Anton Welling Nachf. Oliver Welling e.K.; Microsoft acts as processor in this respect. On the place of storage and on possible third-country aspects, see the section “Transfers to third countries”.

Please note: an unencrypted e-mail is like a postcard. For confidential matters, please use the post or the telephone.

Fonts, images and media

The typeface used, “Open Sans”, is held in our own directory and delivered by the same server as the page. There is no connection to a third-party font service, and no such server learns anything about your visit.

All images are likewise delivered from our own server. No third-party content delivery network is used.

Services not currently in use

The following sections are prepared in advance. None of these services is set up; none processes any data today. They appear here so that it is clear what would have to be added before such a service may be switched on.

These sections and the consent management system are fed from the same configuration file. If a service is switched on, this statement changes with it — and consent is requested from that moment.

Recipients of your data

We do not pass on personal data for advertising purposes and we do not sell them. The only recipients are:

• the server provider as processor, in so far as the processing is technically unavoidable
• the operator of our e-mail system, Microsoft Ireland Operations Ltd., as processor, in so far as you write to us or use one of our forms
• authorities and courts, in so far as we are required by law to do so
• our advisers, in so far as they are bound to confidentiality and knowledge is necessary to carry out the engagement

Transfers to third countries

Opening the pages: no personal data are transferred to a country outside the European Union or the European Economic Area in connection with opening these pages. The server is in Germany; no third-party services are embedded. This also applies to the form service itself, which runs on the same server.

Forms and e-mail: messages from the contact form and the acquisitions form, the confirmation e-mail and e-mails to us are sent, delivered and stored through Microsoft 365 (Exchange Online). The processor is Microsoft Ireland Operations Ltd., based in Ireland. Under Microsoft’s contractual terms, the data of customers in the European Union are stored in data centres within the European Union as part of the so-called EU Data Boundary. It cannot be ruled out, however, that the US parent company, Microsoft Corporation, accesses data in individual cases in the course of support and security services; this may amount to a transfer to the United States.

For such transfers Microsoft relies on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which form part of Microsoft’s data processing agreement (Data Protection Addendum as part of the Product Terms).

Should a further service involving such a transfer be switched on in future, this will be stated here together with the country and the safeguard relied on under Art. 44 et seq. GDPR.

Retention periods

We keep personal data only for as long as is necessary for the respective purpose or as long as a statutory retention obligation applies.

• Server connection data: access log (IP address truncated) at most seven days, defence log (full IP address) at most 48 hours; entries secured to investigate a specific case of abuse at the latest six months after the incident. Calls of the confirmation link are not logged.
• Access statistic (aggregated counts, truncated network addresses): 400 days.
• Form service: IP address (for IPv6, the /64 network) for limiting submissions about one hour, in working memory only; interim storage of a submission (without IP address) until you confirm, about two hours, automatic deletion thereafter; pseudonym of the e-mail address for limiting confirmation e-mails about 24 hours; logs (without message text, IP address truncated) 14 days, except entries secured to investigate a specific case of abuse (at the latest six months after the incident); automatic replies to confirmation e-mails (in info@): prompt deletion.
• Enquiries by form, e-mail, telephone or post: submissions that turn out to be automatically generated spam are deleted promptly; all others until they have been dealt with conclusively, deletion thereafter, unless a statutory retention obligation applies (for example section 257 HGB, section 147 AO).
• Record of your privacy settings: solely in your browser, until you delete it or change your choice. It only comes into existence once consent is obtained at all.

Your rights

As a data subject you have the following rights:

• Access (Art. 15 GDPR): you may request information as to whether and which data we process about you, for which purposes, to which recipients and for how long.
• Rectification (Art. 16 GDPR): you may request that inaccurate data be corrected and incomplete data completed.
• Erasure (Art. 17 GDPR): you may request the erasure of your data, unless a statutory retention obligation applies.
• Restriction of processing (Art. 18 GDPR): you may request that processing be restricted, for example while we verify the accuracy of contested data.
• Data portability (Art. 20 GDPR): you may request that we hand over to you, in a common machine-readable format, the data you provided to us on the basis of consent or a contract.
• Notification obligation (Art. 19 GDPR): we communicate every rectification, erasure or restriction to all recipients to whom the data were disclosed, unless this proves impossible or involves disproportionate effort.

Right to object (Art. 21 GDPR)

In so far as we process data on the basis of a legitimate interest under Art. 6(1)(f) GDPR — here principally the server connection data, the access statistic compiled from it, the abuse prevention of the form service and the handling of enquiries not related to a contract — you have the right to object at any time to that processing on grounds relating to your particular situation.

If you object, we will no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

An informal message to the postal or e-mail address given above is sufficient to object.

Withdrawal of consent (Art. 7(3) GDPR)

If you have consented to processing, you may withdraw that consent at any time with effect for the future. Withdrawing is just as easy as giving consent: as soon as consent to cookies and comparable techniques is obtained, the “Cookie settings” link at the foot of every page suffices for that purpose; otherwise an informal message is enough. The lawfulness of processing carried out until the withdrawal remains unaffected.

Complaint to a supervisory authority (Art. 77 GDPR)

Without prejudice to other remedies, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data infringes the General Data Protection Regulation. The competent authority is that of your place of residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

Are you obliged to provide data?

You are under no statutory or contractual obligation to provide us with personal data. Without a name and contact details, however, we cannot answer an enquiry. Merely reading these pages requires no details at all.

Data security

The website is delivered over an encrypted connection (HTTPS with TLS); the Caddy web server used sets up the encryption automatically and renews the certificates. You can recognise an encrypted connection by the padlock in your browser’s address bar.

We also take technical and organisational measures under Art. 32 GDPR to protect your data against loss, destruction and unauthorised access. The measures are adapted to the state of the art.

Open points

The following details are not yet available as at the date of this statement. They will be added here once settled. They are shown here rather than asserted without foundation:

• Data processing agreement under Art. 28 GDPR with the server provider — conclusion not yet confirmed.
• E-mail system (Microsoft 365): the data processing agreement with Microsoft applies through the Data Protection Addendum as part of the Product Terms. The actual data storage location of the tenant used and the wording of the sections on Microsoft are still to be confirmed by a lawyer.
• Appointment of a data protection officer under Art. 37 GDPR — examination not yet concluded.
• Telephone number of the second office in Cologne — not yet assigned.

Changes to this statement

We amend this statement as soon as the processing operations described change — in particular when a service not previously in use is switched on. The version available here, bearing the date given above, is always the authoritative one.

Note on the status of this text

This statement describes the technical state of the website as at the date given. It is not legal advice. Before the website is published it should be reviewed by a lawyer and completed with the open points listed above.