Privacy policy

This English version is provided for convenience; the German version is legally binding.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as the legal requirements for doing so are not met. If you have any questions about data protection, please contact us at the address above.

2. Principles of processing

We process personal data only insofar as this is necessary to provide a functional website and our content and services, or where you have given your consent. In principle, this website can be used without providing any personal data.

Depending on the processing operation, the legal bases are Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interests).

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

3. Hosting

This website is maintained and operated on our behalf by the agency INSYNC, operated by EL Industries GmbH, Reiserdorf 147, 92721 Störnstein, Germany. It is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, which INSYNC engages as a sub-processor. Vercel delivers the pages via a worldwide network of data centres. Visitors from Europe are generally served from data centres in the EU (e.g. Frankfurt am Main). The server functions through which our forms are sent run exclusively in the Frankfurt am Main region (fra1). When the website is accessed, Vercel processes the technically necessary connection data on our behalf (see section 4).

The legal basis is our legitimate interest in the secure, fast and reliable provision of our website (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with EL Industries GmbH (INSYNC). INSYNC in turn has concluded a data processing agreement with Vercel and bound Vercel accordingly. A transfer of data to the USA cannot be ruled out. Vercel is certified under the EU-US Data Privacy Framework (see section 13, “Data transfer to the USA”).

4. Server log files

Each time this website is accessed, information transmitted by your browser is automatically recorded. This comprises:

• browser type and browser version
• operating system used
• referrer URL
• IP address of the accessing device
• date and time of the server request
• requested file and amount of data transferred

These data are not combined with other data sources. Processing is based on Art. 6(1)(f) GDPR for the purpose of technical operation and defence against attacks. Under our plan, Vercel stores these logs for one day and then deletes them automatically. The logs are not forwarded to any other services (log drains).

5. Contact form

If you send us an enquiry via the contact form, we process the information you provide (name, company, email address, telephone number, subject, message) in order to handle your enquiry and in case of follow-up questions.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in responding to enquiries. The fields marked with * are required in order to process the enquiry; all other information is voluntary.

Your information is sent by email to our mailbox. For sending, our service provider INSYNC (see section 3) engages the email service Brevo of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France, as a sub-processor. The data are processed within the EU. The same applies to the rental interest forms (section 6) and to applications (section 9).

Disclosure within the Scherbaum Group (Scherbaum Unternehmensgruppe) takes place in accordance with section 8. No disclosure is made to third parties outside the group, with the exception of the service providers named, who support us as processors.

6. Rental interest

Via the “Rental interest” form we collect information about your search for a home (number of rooms, preferred size, number of occupants, move-in period, optional remarks) as well as your contact details. We process these data in order to handle your rental interest and to contact you when letting begins or about suitable available apartments in our properties.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). Your information is passed on to the responsible project or letting company in which the Scherbaum Group holds an interest and which owns or lets the apartments on the basis of your consent (Art. 6(1)(a) GDPR), see section 8.

We store your information until a suitable apartment has been arranged for you or you withdraw your consent, but for no longer than 24 months. You may withdraw your rental interest and your consent at any time, without any particular form and with effect for the future, e.g. by email to datenschutz@scherbaum.de. We will then delete your information without delay.

7. Contact by email or telephone

If you contact us by email or telephone, we process your information in order to handle your request. The legal basis is Art. 6(1)(b) or (f) GDPR. Please note that data transmission over the internet, for example when communicating by email, may have security gaps. Complete protection against access by third parties is not possible.

8. Disclosure within the Scherbaum Group

Scherbaum Project GmbH is part of the Scherbaum Group. We may pass on personal data that you provide to us, for example via contact forms, by email, by telephone or in the course of a business relationship, to other companies of the Scherbaum Group insofar as this is necessary for the following purposes:

• handling and responding to your enquiries, e.g. regarding rental or purchase interest, projects or cooperation
• initiating, concluding and performing contracts
• managing existing business relationships
• internal administrative purposes within the group

Recipients are in particular the respective project company in which the Scherbaum Group holds an interest and which owns or lets the property concerned, as well as other companies of the Scherbaum Group responsible for the respective purpose, for example letting, management, project development or construction.

The legal bases are your consent (Art. 6(1)(a) GDPR), insofar as you have given it, the performance of a contract or of pre-contractual measures (Art. 6(1)(b) GDPR), and our legitimate interest in efficient organisation within the group (Art. 6(1)(f) GDPR, cf. Recital 48 GDPR).

On request, we will inform you to which companies of the group your data have been passed on in the individual case.

9. Applications

If you apply to us via the form on the “Careers” page or by email, we process your information and documents (in particular name, contact details, cover letter, CV, any further documents, message) in order to carry out the application procedure. The legal basis is Art. 6(1)(b) GDPR. For longer storage with a view to future vacancies, we obtain your separate consent (Art. 6(1)(a) GDPR).

If no employment relationship is established, we will delete your documents no later than six months after the conclusion of the procedure. If you have given your consent, we will store your documents for up to 24 months for future vacancies. Disclosure within the Scherbaum Group takes place only insofar as the position is based at another company of the group (see section 8).

10. Newsletter

If you subscribe to our newsletter, we use your email address to send you news about our projects. Any further information is voluntary. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can also subscribe via the contact form and the rental interest forms.

The newsletter is sent by Scherbaum Project GmbH or by the responsible project or letting company of the Scherbaum Group. For this purpose, your email address is shared within the group to the extent necessary for sending (see section 8). Here, too, the legal basis is your consent.

Subscription uses the double opt-in procedure: after subscribing, you will receive an email with a confirmation link. Only after confirmation is your address added to the mailing list. We store the time of subscription and confirmation as well as the IP address in order to be able to prove the subscription (Art. 6(1)(c) and (f) GDPR).

For subscription and sending, our service provider INSYNC (see section 3) engages the service Brevo of Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France, as a sub-processor. The data are processed within the EU. We do not evaluate opens or clicks in our newsletters; the corresponding tracking is disabled in the sending service.

You can unsubscribe from the newsletter at any time via the unsubscribe link in each issue or by email to datenschutz@scherbaum.de. We will then remove your address from the mailing list; we keep proof of your earlier consent for up to three years.

11. Fonts

This website uses the Sora typeface. The font files are delivered from our own server. No connection is established to servers of Google or other third-party providers; to this extent, no data are transmitted to third parties.

12. Images, videos and map link

All images and videos, the project map and the interactive district model are delivered from our own web server (see section 3). We do not embed content from third parties such as YouTube, Vimeo or Google Maps.

On the contact page we link to our location on Google Maps, and on the project pages we link to press articles. Only when you click such a link does the respective provider’s service open, e.g. that of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. From then on, that provider’s privacy policy applies. As long as you do not click the link, no data are transmitted to the provider.

13. Cookies and statistics

Technically necessary cookies and storage

On our website we use cookies and comparable technologies (your browser’s local storage) insofar as they are strictly technically necessary for the operation and display of the website, e.g. to store your cookie settings. We store your choice together with the time in your browser’s local storage (entry “scherbaum.cookieConsent.v1”); no cookie is set for this. After twelve months we ask you again. The legal basis is § 25(2) no. 2 of the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) in conjunction with Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free provision of our website. If you click “Decline”, only these technically necessary functions are used.

Statistics with Vercel Web Analytics (only with consent)

With your consent, we use Vercel Web Analytics, a service of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, which our service provider INSYNC (see section 3) engages as a sub-processor, to evaluate, without cookies and without user profiles, which pages are accessed and how often. The data recorded are the page accessed, referrer, browser, operating system, device type and country. Visitors are distinguished only by means of a hash that changes daily and cannot be traced back to you.

The script is loaded only after you have selected “Accept” in the cookie banner or activated the “Statistics” category. Until then, no data are transmitted to Vercel. The legal basis is your consent pursuant to § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

Data transfer to the USA

Vercel has its registered office in the USA. Vercel Inc. is certified under the EU-US Data Privacy Framework; an adequacy decision of the European Commission (Art. 45 GDPR) therefore exists for the transfer. Should we in future use further services based in the USA that are not certified, the transfer will take place exclusively on the basis of your consent (Art. 49(1)(a) GDPR). In that case, we point out that a level of data protection comparable to that of the EU is not guaranteed in the USA and that US authorities may, under certain circumstances, access your data without effective legal remedies being available to you.

Withdrawal and changes

You may withdraw your consent at any time with effect for the future or change your selection. To do so, use the “Cookie settings” link in the footer of our website or open the cookie settings here.

14. Storage period

We store personal data only for as long as is necessary for the purposes stated or as required by statutory retention periods. We delete enquiries submitted via the contact form once they have been fully processed and no statutory retention obligations apply. For rental interest, applications and the newsletter, the periods stated in sections 6, 9 and 10 apply. Server log files are deleted automatically after one day (see section 4).

15. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR, see below)
• right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an informal message to the address above or to datenschutz@scherbaum.de is sufficient.

16. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

17. Changes to this policy

We will amend this privacy policy as soon as changes to the procedures we use or to the legal situation make this necessary. The version available on this page applies in each case.

Last updated: October 2026