Legal

Data Privacy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

Lestate Real Group GmbH
Stockkampstraße 53, 40477 Düsseldorf, Germany
Email: hello@lestatereal.com

Represented by the managing directors Jan Philipp Leuker and Benjamin Böhme. Registered with the Local Court (Amtsgericht) Düsseldorf, HRB 114519.

We are not legally required to appoint a data protection officer and have not appointed one. Please direct all data protection enquiries to the contact details above.

2. Overview

We process personal data only where this is necessary to provide a functioning website, to respond to your enquiries, to handle job applications, or where we are legally obliged to do so. Which data we process, for what purpose, on which legal basis and for how long is set out for each processing activity below.

All data transmitted between your browser and our website is encrypted using TLS (HTTPS).

3. Legal Bases

Unless a more specific legal basis is stated for an individual processing activity, the following applies:

Art. 6(1)(a) GDPR – where you have given consent. Consent may be withdrawn at any time with effect for the future (see section 10).
Art. 6(1)(b) GDPR – where processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract.
Art. 6(1)(c) GDPR – where processing is necessary to comply with a legal obligation, in particular commercial and tax retention obligations.
Art. 6(1)(f) GDPR – where processing is necessary for our legitimate interests or those of a third party, provided that your interests or fundamental rights do not override these. The relevant legitimate interest is stated for each activity below.
§ 26 of the German Federal Data Protection Act (BDSG) – for the processing of applicant data in the context of establishing an employment relationship.

4. Website Access and Hosting

4.1 Server Log Files

Each time our website is accessed, the following data is automatically transmitted by your browser and stored in server log files:

IP address of the requesting device
Date and time of the request
Name and URL of the retrieved file, and the HTTP status code
Website from which access was made (referrer URL)
Browser type and version, operating system, and the name of your access provider

Purpose and legitimate interest: delivering the website, ensuring system security and stability, and detecting and defending against attacks and misuse. Legal basis: Art. 6(1)(f) GDPR. The log data is not merged with other personal data and is not used to draw conclusions about your person. Retention: log files are deleted after no more than 30 days, unless retention is required to investigate a specific security incident.

The provision of this data is neither required by law nor by contract; however, the website cannot be delivered to your device without it.

4.2 Hosting Provider

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States (“Vercel”). Vercel processes the data listed in section 4.1 on our behalf and on our instructions as a processor within the meaning of Art. 28 GDPR. We have concluded a data processing agreement with Vercel. Vercel delivers the website through a global content delivery network and may therefore process access data on servers outside the European Economic Area, including in the United States.

Third-country transfer: Vercel Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) apply. Further information: vercel.com/legal/privacy-notice.

4.3 Cookies, Tracking and Third-Party Content

Our website does not set cookies, does not use web analytics or tracking tools, does not embed content from third-party servers (such as external fonts, maps, videos, or social media plug-ins), and does not store or read information on your device within the meaning of § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). No profiling takes place. Should any of this change, we will update this privacy policy beforehand and obtain your consent where required.

4.4 Portal Sign-in Pages

The sign-in pages for our investor, Realaize and Werkr portals are currently provided for information purposes only. Entries in these forms are validated exclusively in your browser and are neither transmitted to nor stored on our servers or those of third parties.

5. Contact by Email

If you contact us by email – for example via the addresses provided on our website or by submitting a property opportunity in response to our acquisition profile – we process the data you provide (in particular your name, email address, the content of your message, and any attachments) in order to handle your enquiry and any follow-up questions.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract with us; otherwise Art. 6(1)(f) GDPR, our legitimate interest being to respond to enquiries directed at us.

Recipients: your email is processed by the email service provider we use, which acts as our processor under Art. 28 GDPR. No further disclosure to third parties takes place unless we are legally obliged to do so or you have consented.

Retention: we delete your data once the enquiry has been fully handled and no further correspondence is to be expected, unless statutory retention obligations (in particular under commercial and tax law, § 257 HGB and § 147 AO, currently up to ten years) require longer storage. Correspondence that leads to a contract is retained for the duration of the business relationship and the subsequent statutory retention periods.

Providing your data is voluntary; however, we cannot respond to your enquiry without it.

6. Job Applications

You may apply for positions advertised on our website by email. We process the data you provide in the course of your application (in particular name, contact details, CV, cover letter, certificates, availability, and any other information you choose to share) for the purpose of assessing your suitability for the advertised position and conducting the application procedure.

Legal basis: § 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR (steps prior to entering into an employment contract). Where you provide special categories of personal data within the meaning of Art. 9(1) GDPR (for example information on health or a severe disability), processing is based on § 26(3) BDSG and Art. 9(2)(b) GDPR. Where processing is necessary to defend against legal claims, Art. 6(1)(f) GDPR additionally applies.

Recipients: your application is seen only by the persons within our company who are involved in the hiring decision and by our email service provider as processor. It is not disclosed to other third parties.

Retention: if your application is unsuccessful, we delete your data six months after the conclusion of the application procedure, unless you have consented to a longer retention in our applicant pool or the data is required to defend against legal claims (in particular under the German General Equal Treatment Act, AGG). If your application is successful, the data is transferred to your personnel file.

Providing your data is voluntary; without it we cannot consider your application. Please do not send information that is not relevant to the position.

7. Recipients and Third-Country Transfers

We disclose personal data only to the processors named in this policy (hosting provider, email service provider), to authorities or courts where we are legally obliged to do so, and to legal or tax advisers bound by professional secrecy where necessary to assert or defend legal claims. Apart from the hosting described in section 4.2, no transfer to countries outside the European Economic Area takes place.

8. No Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Retention in General

Unless a specific retention period is stated above, we delete personal data as soon as the purpose for which it was collected no longer applies and no statutory retention obligations require continued storage. Where data must be retained for legal reasons, its processing is restricted and it is deleted upon expiry of the retention period.

10. Your Rights

You have the following rights with regard to the personal data concerning you:

Right of access (Art. 15 GDPR) – to obtain confirmation as to whether we process your personal data and, if so, access to that data and the further information listed in Art. 15 GDPR.
Right to rectification (Art. 16 GDPR) – to obtain the correction of inaccurate data and the completion of incomplete data.
Right to erasure (Art. 17 GDPR) – to obtain the deletion of your data where one of the grounds set out in Art. 17 GDPR applies.
Right to restriction of processing (Art. 18 GDPR) – to obtain the restriction of processing where one of the conditions in Art. 18 GDPR is met.
Right to data portability (Art. 20 GDPR) – to receive the data you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller.
Right to withdraw consent (Art. 7(3) GDPR) – to withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object (Art. 21 GDPR). Where we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object at any time, on grounds relating to your particular situation, to such processing. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing purposes, you may object at any time without stating reasons.

Right to lodge a complaint (Art. 77 GDPR). Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. Email: poststelle@ldi.nrw.de, website: www.ldi.nrw.de.

11. Exercising Your Rights

To exercise any of the rights listed above, an informal message to us is sufficient:

Lestate Real Group GmbH
Stockkampstraße 53, 40477 Düsseldorf, Germany
Email: hello@lestatereal.com

We will respond without undue delay and in any event within one month of receipt of your request (Art. 12(3) GDPR). Where we have reasonable doubts as to your identity, we may request additional information necessary to confirm it.

12. Amendments

We reserve the right to amend this privacy policy to reflect changes to our website, our services, or the legal situation. The version published on this website is the current version. Amendments do not affect the lawfulness of processing carried out before the amendment.

Last updated: 22 September 2026