Skip to main content
GUTHMANN®
GUTHMANN® Logo
DE Contact

Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to personally identify you. For detailed information on data protection, please refer to our privacy policy below.

Data Collection on This Website

Data collection on this website is carried out partly by the website operator. Your data is collected through technically necessary processing (e.g. session management, hosting) and, where applicable, through analytics and marketing tools. Analytics and marketing tools are only activated after your explicit consent.

Other data is collected automatically by our IT systems when you visit the website. This primarily includes technical data (e.g. internet browser, operating system, IP address, or time of page access). This data is collected automatically as soon as you enter our website.

Analytics Tools, Marketing and Third-Party Tools

We carry out cookieless, anonymized reach measurement (Umami) on the basis of our legitimate interest without consent. Any further cookie-based analysis of your browsing behavior (Google Analytics, Mouseflow), as well as the recognition of returning visits, only occurs after your explicit consent via our cookie banner. Likewise only with your consent, we use marketing tools from Meta (Meta Pixel and Conversions API) and Google (Google Ads) to show you property listings from our website as ads and to measure how our ads perform. You choose analytics and marketing separately. You can revoke your consent at any time via the “Cookie Settings” link in the website footer or on this privacy policy page.

2. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the applicable data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to personally identify you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

We would like to point out that data transmission over the internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information About the Responsible Party

The responsible party for data processing on this website is:

Guthmann Estate GmbH
Blücherstraße 22
10961 Berlin

Phone: +49 30 69004240
Email: info@guthmann.estate

The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses, etc.).

For all data protection matters — in particular access, correction, and deletion requests — you can reach us at privacy@guthmann.estate.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You can revoke any consent you have already given at any time. An informal notification by email to us is sufficient. The legality of the data processing carried out before the revocation remains unaffected by the revocation.

Right to Lodge a Complaint with the Supervisory Authority

In the event of data protection violations, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is:

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: https://www.datenschutz-berlin.de

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of data to another responsible party, this will only be done to the extent that it is technically feasible.

SSL/TLS Encryption

This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator. You can recognize an encrypted connection by the fact that the browser address bar changes from “http://” to “https://” and by the lock icon in your browser bar.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Access, Restriction, Deletion

Within the framework of applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin, recipients, and the purpose of data processing, as well as a right to correction, restriction, or deletion of this data (Art. 15–18 GDPR). For inquiries regarding your data subject rights — in particular access or deletion requests — please contact us directly at privacy@guthmann.estate. Alternatively, you can reach us at the address given in the legal notice.

Objection to Promotional Emails

The use of contact data published as part of the legal notice obligation for sending unsolicited advertising and information materials is hereby objected to. The operators of the website expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, such as spam emails.

3. Hosting and Content Delivery

Cloudflare Workers

This website is hosted on Cloudflare Workers. The provider is Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA (hereinafter “Cloudflare”).

Cloudflare Workers is a serverless platform that runs web applications at the edge (i.e. in data centers close to the visitor). When you access our website, your request is automatically routed to the nearest Cloudflare data center. Technical data such as your IP address, browser type, and the page accessed are processed in this context.

Cloudflare is certified under the EU-US Data Privacy Framework. More information can be found in Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

The use is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable, fast, and secure provision of our website.

Cloudflare CDN

We use Cloudflare’s Content Delivery Network (CDN). This caches content of our website in Cloudflare data centers (edge caching) to reduce loading times and increase availability. When cached content is accessed, your request is answered directly from the nearest Cloudflare data center without contacting our origin server.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in performant content delivery).

Cloudflare Speed Brain

We use Cloudflare Speed Brain, a service for speculative preloading (prefetching) of pages at the edge level. Cloudflare analyzes navigation behavior in aggregate to predict which page a visitor might access next and preloads it in the background. No personal data is stored in this process.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in faster page navigation).

4. Data Collection on Our Website

Cookies and Consent Management

This website uses one cookie to identify your session:

  • Name: _privacy_session
  • Purpose: Identification of the browser session and storage of your consent preferences
  • Properties: HttpOnly, Secure, SameSite=Strict
  • Duration: 30 days (automatically renewed on repeat visit)

For consent management, we use the open-source library “Vanilla Cookie Consent.” On your first visit, a cookie banner appears where you can grant or reject your consent. Your preferences are stored in our server-side session management (Cloudflare KV) and additionally in the “_consent” cookie, so that the banner does not reappear on every page view:

  • Name: _consent
  • Purpose: Storage of your choice in the cookie banner (selected categories and banner version); contains no personal data and no session ID
  • Properties: Secure, SameSite=Lax
  • Duration: 12 months

We distinguish three categories:

  • Necessary (always active): Technically required functions such as session management and storage of your consent decision.
  • Analytics (opt-in): Cookie-based statistical analysis through Google Analytics via Google Tag Manager, session recordings and heatmaps (Mouseflow), as well as the recognition of returning visits in our cookieless web analytics (Umami analytics ID). Only activated after your explicit consent.
  • Marketing (opt-in): Meta Pixel and Meta Conversions API as well as Google Ads conversion tracking and remarketing. This lets us show you property listings you viewed on our website on Facebook, Instagram and Google services, and measure whether ads led to an enquiry (see section 6). Only activated after your explicit consent, independently of the “Analytics” category.

You can change or revoke your cookie settings at any time via the “Cookie Settings” link in the website footer. When you revoke consent, we automatically delete the cookies of the affected category.

The legal basis for consent management is Art. 6(1)(c) GDPR (legal obligation). The session cookie is set on the basis of Art. 6(1)(f) GDPR (legitimate interest in the technically error-free provision of the website).

Independently of the cookie banner, we carry out cookieless, anonymized reach measurement (Umami) on the basis of our legitimate interest (see the “Umami (cookieless web analytics)” section under Analytics Tools). This does not set any cookies and does not require consent.

Server Log Files

The hosting provider (Cloudflare) automatically collects and stores information that your browser transmits with every page request. This includes:

  • Browser type and version
  • Operating system
  • Referrer URL
  • IP address
  • Time of server request
  • Country and region (via Cloudflare geolocation)

This data is not merged with other data sources. The legal basis for data processing is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable provision of the website).

Session Management and First-Touch Attribution

When you first visit our website, a server-side session is created and linked via the session cookie (_privacy_session) described above. Session data is stored in Cloudflare KV (key-value store) and automatically deleted after 30 days.

The following data is collected and stored on your first visit (first-touch attribution):

  • UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) — to identify the origin of your visit
  • Advertising click IDs (gclid, fbclid, msclkid, li_fat_id, twclid) — to attribute ad campaigns
  • Landing page (pathname without query parameters) — to analyze the entry page
  • Cookie consent status — your consent preferences

When a form is submitted, the following additional data is collected at the time of submission (live enrichment):

  • Geolocation data from Cloudflare (country, region, city, timezone) — not GPS data, but inferred from the Cloudflare data center
  • User agent (browser and device information)
  • IP address as SHA-256 hash with salt — no plaintext IP address is stored
  • Referrer (last page visited)

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in attributing inquiries to marketing channels and optimizing our advertising campaigns. The IP address is stored exclusively as a cryptographic hash and serves for abuse prevention (rate limiting).

Contact Form

When you send us inquiries via the contact form, the following data is collected: first name, last name, email address, phone number (optional), and your message. You may also optionally consent to receiving our newsletter.

The data is processed through a server-side workflow (Cloudflare Workflow) and forwarded to our team via email (Mailgun, EU region). If you consent to the newsletter, your email address is additionally added to our newsletter system and you receive a confirmation email (see the Newsletter section).

Processing is based on Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent for newsletter opt-in). The data will remain with us until you request deletion or the purpose for data storage no longer applies.

Newsletter

When you subscribe to our newsletter, we store your email address, the selected language (German/English), the selected topics, the time and origin of your subscription and, if provided, your name in our own newsletter system (Directus, operated on servers in the EU). Delivery is handled by Mailgun (Sinch Email, EU region, see section 8).

We use the double opt-in procedure: after signing up, you receive a confirmation email with a link that is valid for 72 hours. If you do not confirm, we remind you once after 48 hours; after that the subscription has no effect. You only receive the newsletter once you have confirmed.

Our newsletters contain a tracking pixel that lets us measure whether an email was opened. This transmits the time and the email client used to Mailgun. We evaluate this data in statistical form only, to improve content and sending frequency. Links in the newsletter are not redirected through Mailgun; if you open a page of our website from the newsletter, our web analytics (Umami, see section 5) attributes the visit to the respective issue. You can prevent open measurement by disabling automatic image loading in your email client.

The legal basis is Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time: via the unsubscribe link in every newsletter email, via the unsubscribe function of your email client, or on the preferences page where you can change topics and language. After you unsubscribe, we keep your email address together with the date of unsubscription so that you are not contacted again (Art. 6(1)(c) and (f) GDPR). In September 2026 we migrated existing subscriber data from our former newsletter service Mailchimp to our own system; Mailchimp is no longer used. More information: Mailgun Privacy Policy

Property Valuation

Through our property valuation form, you can request a data-driven estimate for a Berlin property. The following data is collected: property address, property type, and living area.

To access the valuation result, you may optionally provide contact details (first name, last name, email, phone). In this case, you will receive an access code by email (Mailgun, EU region).

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). Valuation data is stored in our CMS (Directus).

You may request the deletion of the data submitted for the property valuation at any time by contacting privacy@guthmann.estate. Unless retention is required by commercial or tax law, we will delete your data without undue delay.

Search Request / Search Profile

Through our search profile form, you can let us know your property preferences. The following data is collected: area of interest, preferred boroughs, maximum purchase price, message, and your contact details (first name, last name, email, phone).

The data is forwarded to our sales team via email (Mailgun, EU region) and may additionally be created as a search profile in our property management system (Propstack).

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures).

Property Inquiry

On property detail pages, you can submit an inquiry about a specific property via a contact form. In addition to your contact details (first name, last name, email, phone, message), the context of the requested property is transmitted.

Processing is carried out as for the general contact form (see above). The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures).

5. Analytics Tools

Google Tag Manager

This website uses Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Tag Manager is a tool that allows us to manage tracking and analytics tags on our website. Google Tag Manager itself does not store cookies and does not collect personal data.

We use Google Tag Manager with Google Consent Mode v2. Tag Manager is loaded when you open a page; for technical reasons, your browser transmits your IP address to Google in doing so. All consent signals are initially set to “denied.” Analytics tags only run once you have consented to the “Analytics” category, marketing tags only once you have consented to the “Marketing” category. Before that, no analytics or advertising cookies are set or read.

The legal basis for embedding Tag Manager is Art. 6(1)(f) GDPR (legitimate interest in managing tags and in technically implementing your consent decision). For the analytics and marketing tags it runs, the legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). More information: Google Privacy Policy

Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited. Google Analytics is loaded exclusively via Google Tag Manager and is only activated when you have consented to the analytics category via our cookie banner.

Google Analytics uses cookies (e.g. _ga, _gid) that enable analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to and stored on a Google server.

We use Google Analytics with IP anonymization. Google Analytics 4 anonymizes IP addresses by default, so your IP address is not stored in full.

The legal basis is Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time via the “Cookie Settings” link in the footer. Upon revocation, analytics cookies are automatically deleted.

We have concluded a data processing agreement with Google. More information: Data protection at Google Analytics

Umami (cookieless web analytics)

In addition to Google Analytics, we use Umami, a self-hosted web analytics tool (server: stats.guthmann.estate, operated by us). Umami helps us statistically evaluate the use of our website and improve our offering.

Umami works cookieless: it does not set any cookies, does not store or read any information on your device, and does not create cross-device or cross-site profiles. To distinguish visits, only an anonymized, non-reversible daily hash derived from IP address, browser information, and domain is generated in memory and discarded daily. The IP address is not stored.

We record, for example, pages visited, referrer source, approximate origin (country), device type, browser, and screen size, as well as selected interactions (such as submitted forms or clicks on contact options) in anonymized, aggregated form.

The legal basis is our legitimate interest in data-minimizing, privacy-friendly reach measurement (Art. 6(1)(f) GDPR). Because Umami works cookieless and does not create personal profiles, no consent is required for this. No transfer to third parties takes place; the data remains on our own infrastructure. You can object to the collection by enabling the “Do Not Track” setting in your browser; we respect this setting.

Recognition of returning visits (only with consent): If you additionally consent to the “Analytics” category via our cookie banner, we pass a pseudonymous analytics ID to Umami. It consists of a non-reversible cryptographic hash (SHA-256) of your server-side session identifier and makes it possible to merge returning visits. Without your consent, this ID is not set; upon revocation, it is removed. The legal basis for this is Art. 6(1)(a) GDPR (consent).

Mouseflow (Session Recording and Heatmaps)

On this website we use Mouseflow, an analytics service provided by Mouseflow ApS (Flæsketorvet 68, 1711 Copenhagen, Denmark). Mouseflow records individual visits on a sampled basis in order to understand and improve the usability of our website.

This captures mouse movements, clicks, scrolling behavior, and page changes, as well as technical information such as browser, operating system, approximate location (country), and screen size. From this data, session recordings (replays) and aggregated heatmaps are generated. Entries in form fields are masked by default and are not recorded in plain text.

Mouseflow is loaded exclusively via Google Tag Manager and is only activated after you have consented to the “Analytics” category via our cookie banner. Without your consent, no recording takes place. For this purpose, Mouseflow sets cookies to recognize you within a session.

The legal basis is Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time via the “Cookie Settings” link in the footer. We have concluded a data processing agreement with the provider; processing takes place within the EU. More information: Data protection at Mouseflow

6. Marketing and Remarketing

We only use the following services if you consent to the “Marketing” category in the cookie banner. This category is independent of “Analytics”: you can allow analytics and decline marketing, or the other way round.

Meta Pixel

With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) on this website. The Pixel is loaded via Google Tag Manager.

The Pixel reports to Meta which pages you visit (PageView), which property exposés you view (ViewContent, with listing ID and price), which search filters you use (Search) and whether you submit a form (Lead). In doing so, your IP address, browser and device information, the page URL and the cookies _fbp (browser ID) and _fbc (click ID, if you arrive via a Meta ad) are transmitted. Both cookies are stored for 90 days. If you are logged in to Facebook or Instagram, Meta can link the visit to your account.

We use this data to show you ads on Facebook and Instagram for properties you viewed on our website (dynamic remarketing), to build audiences for our ads and to measure whether ads led to enquiries. For these ads, we provide Meta with a catalog of our property listings; it contains no personal data.

We are jointly responsible with Meta for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR). This is governed by Meta's Controller Addendum (facebook.com/legal/controller_addendum), under which Meta handles data subject requests concerning the data processed by Meta. Meta is solely responsible for any further processing at Meta.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can revoke it at any time via the “Cookie Settings” link in the footer; the _fbp and _fbc cookies are then deleted. Meta also processes data in the USA (see section 9). More information: Meta Privacy Policy

Meta Conversions API

In addition to the Pixel, we send selected events directly from our server to Meta (Meta Conversions API): viewing a property exposé (ViewContent) and submitting one of our forms (Lead). The server only sends if you have consented to the “Marketing” category. Without this consent, no event is transmitted, not even from the server.

We transmit the time, the page URL, your IP address, browser information (user agent), the values of the _fbp and _fbc cookies or the click ID of a Meta ad through which you reached us (fbclid), and the ID and price of the exposé concerned. For a form enquiry, we also send the type of enquiry as well as your email address and, if provided, phone number, first and last name. Before transmission, these contact details are hashed with SHA-256 on our server, i.e. converted into an irreversible checksum. Meta does not receive them in plain text but can match them against the data of its own user accounts.

The purpose is to attribute exposé views and enquiries to the right ad even when the Pixel is blocked in the browser. Browser and server events carry the same event ID, so Meta counts each event only once. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can revoke via the “Cookie Settings.” Joint responsibility and the transfer to the USA are handled as described for the Meta Pixel.

Google Ads (Conversion Tracking and Remarketing)

With your consent, we use Google Ads of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Ads tags run via Google Tag Manager.

Conversion tracking: If you reach our website via a Google ad, Google stores an ID of the ad click in cookies (e.g. _gcl_au, _gcl_aw; stored for 90 days). If you then submit an enquiry, we and Google learn that the ad led to an enquiry. We do not receive any information that allows us to identify you personally.

Remarketing: If you view a property exposé or search results, we send Google the ID and price of the property viewed or your search. Google can then show you these listings again in Google Search, on YouTube and on websites in the Google advertising network. If you are logged in to your Google account and have allowed personalized ads, Google can do so across devices. For these ads, we provide Google with a catalog of our property listings; it contains no personal data.

Google processes this data as an independent controller (Google Ads Controller-Controller Data Protection Terms). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can revoke it at any time via the “Cookie Settings” link in the footer; the _gcl cookies are then deleted. You can also turn off personalized ads from Google at adssettings.google.com. Google is certified under the EU-US Data Privacy Framework. More information: How Google uses cookies in advertising

7. Plugins and Tools

Mapbox

This website uses the mapping service Mapbox (Mapbox Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA). Mapbox is used on property detail pages and location maps to display maps, geocoding, and location information.

When loading a map, your browser connects to Mapbox servers. This transmits data including your IP address and information about the requested map view. Mapbox uses a public access token (visible in the client). Additionally, events are sent to the Mapbox Events API (events.mapbox.com).

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the appealing presentation of our property locations). As Mapbox transfers data to the USA, the transfer is based on Standard Contractual Clauses. More information: Mapbox Privacy Policy

Cloudflare Turnstile

We use Cloudflare Turnstile as bot protection on all forms on our website. Turnstile is a CAPTCHA service by Cloudflare Inc. that automatically checks form submissions for bot activity without using traditional image puzzles.

When loading a form, a script from challenges.cloudflare.com is embedded. Cloudflare processes technical data such as IP address, browser information, and interaction data to distinguish between human visitors and bots.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting our forms from abuse). More information: Cloudflare Privacy Policy

Propstack

For displaying property photos, we use images served via the CDN service of Propstack (images.propstack.de). When loading these images, your browser connects to Propstack servers, transmitting your IP address and the referrer.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in displaying current property images).

8. Email Delivery and External Services

Mailgun

For sending email notifications upon form submissions, system emails (such as confirmations and access codes) and our newsletter, we use Mailgun (Sinch Email, Lindhagensgatan 74, 112 18 Stockholm, Sweden). We exclusively use Mailgun’s EU region (api.eu.mailgun.net), ensuring that email processing takes place within the EU.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the reliable delivery of notifications) and, for the newsletter, Art. 6(1)(a) GDPR (consent). More information: Mailgun Privacy Policy

Directus CMS

We use Directus as our content management system (CMS) for managing the content of this website. Directus is operated on our own servers (content.guthmann.estate). Access to Directus occurs exclusively server-side — no data is transmitted directly from your browser to Directus.

Form data (contact inquiries, valuations) is stored server-side in Directus. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the efficient management of our content and inquiries).

Sentry (Error Diagnostics)

To detect and fix technical errors, we use Sentry, a service provided by Functional Software, Inc. (dba Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. If a technical error occurs while you visit our website — on our servers or in your browser — an error report is transmitted to Sentry.

An error report contains details about the error (error message, affected code location), technical information about browser and operating system, the page accessed without URL parameters, and the version of our software. Form inputs, cookies, and URL parameters are automatically removed before transmission, and email addresses are redacted from error messages. The IP address is not stored.

On our website, Sentry works without cookies and does not store or read any information on your device; there is no session recording and no tracking of your usage behavior. Consent is therefore not required. In addition, we collect sampled technical performance data (response times) on the server side, without any involvement of your browser.

We use Sentry’s EU data region; error reports are processed in the European Union and automatically deleted after 90 days. A data processing agreement is in place with the provider; Functional Software, Inc. is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technically error-free and secure provision of our website). More information: Sentry Privacy Policy

9. Third-Country Transfers

Some of the services mentioned above process data outside the European Union, particularly in the USA. The following safeguards apply to these transfers:

  • Cloudflare, Google: Certified under the EU-US Data Privacy Framework
  • Meta (Meta Platforms Ireland Limited): Transfer to Meta Platforms, Inc. in the USA; certified under the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR
  • Mapbox: Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR
  • Mailgun (Sinch): Processing in the EU region (api.eu.mailgun.net)
  • Sentry (Functional Software, Inc.): Processing in the EU data region (de.sentry.io); provider certified under the EU-US Data Privacy Framework

10. Currency and Changes to This Privacy Policy

This privacy policy is currently valid as of September 2026. Due to the continued development of our website or changes in legal or regulatory requirements, it may be necessary to amend this privacy policy.