Privacy policy

1. Controller

The controller for the processing of your data on this website is RED Real Estates Development Bauträger und Immobilien GmbH (“RED”, “we”), Sterngasse 3/2/6, 1010 Vienna, Austria.

For questions about data protection, reach us through the form, by email (address in the legal notice) or by phone:

2. What this is about

We want to explain why and how we process your personal data and which rights you have. We process only the data we need for the purpose at hand and pass it on only for a reason we name here.

We do not send a newsletter.

3. Purposes and legal bases

• Enquiries, expose, search profile, valuation, appointment, callback, message, careers: pre-contractual measures and performance of a contract (Art 6(1)(b) GDPR). We process the details you enter in the form to answer your enquiry.
• Legal obligations (Art 6(1)(c) GDPR): retention duties under company and tax law and the due diligence duties to prevent money laundering and terrorist financing (sections 365m et seq. of the Austrian Trade Act). For a mandate this includes identification, identifying the beneficial owner and clarifying the origin of funds.
• Legitimate interest (Art 6(1)(f) GDPR): secure operation of the website, protection against abuse and spam, internal administration in the enquiry records, documentation (for example of your acceptance of the terms and your request for an early start of services) and establishing and defending legal claims.
• Consent (Art 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021): statistics and analytics. Without your consent we do not load these services. You can withdraw consent at any time with effect for the future, see section 10.

4. Visiting the website

When you open the website, our hosting provider processes technically necessary connection data, in particular IP address, time, requested address, browser and operating system. This is required to deliver and secure the site (Art 6(1)(f) GDPR).

In addition, Vercel Web Analytics counts page views and events without a cookie. Visitors are told apart only by a hash of the request that is reset after one day. No consent is required for this.

5. Forms and contact

When you submit a form, we process what you enter: depending on the form your name, email address, phone number, preferred time, property reference, details about your property or search profile and your message. We also store the page, language, time and the versions of the privacy policy and the terms you agreed to. For valuation, discreet sale and search profile requests we also store that and when you requested an early start of services (section 10 FAGG).

We send the enquiry by email to our office and confirm receipt by email if you gave us an address. For valuation, discreet sale and search profile requests the confirmation contains a summary of your details, the withdrawal information and the model withdrawal form. Spam protection consists of a hidden field, a minimum time, a rate limit per address and, where enabled, Cloudflare Turnstile (section 8).

Enquiry records

We also store every enquiry in our enquiry records. This is a database that only the office can access through a password-protected login. We use it to note the processing status and internal notes; once a day the office receives an overview of new enquiries by email. To detect abuse we store the browser identifier (user agent) with the enquiry and the IP address only as an encrypted check value (HMAC), never in plain text. Supabase operates the database for us as a processor; it is located in the EU (section 8). We delete entries once the enquiry is closed and 180 days have passed since it was received, unless it leads to a transaction for which longer periods apply (section 11). The legal basis is Art 6(1)(b) and (f) GDPR.

If you request the seller's guide, we send you a personal download link by email that is valid for seven days. We log downloads of the link only with check values (no plain-text address) and delete the log after 400 days.

6. Property enquiries and brokerage software

Property data and expose requests run through the brokerage software JustImmo. The provider is based in Austria and processes your enquiry as our processor under Art 28 GDPR. For a property enquiry we pass your details to JustImmo so the expose, including the commission details and the withdrawal information, can be sent to you and the enquiry can be matched to the property. We keep a copy of the enquiry in our enquiry records (section 5).

If you save properties, the selection is stored only in your browser (localStorage, key “red-favoriten”). It is not transmitted to us.

7. Chat

In the chat an AI assistant answers first questions about RED and our properties. We process your messages with the service of Anthropic PBC (USA) through its programming interface. Under Anthropic’s commercial terms, Anthropic may not train models on customer content from this service. According to Anthropic, inputs and outputs of the interface are deleted by default within 30 days, with exceptions for example for violations of the usage policy and legal obligations. Anthropic’s data processing addendum governs the processing on our behalf (Art 28 GDPR).

Before your first message the chat tells you that answers are written by an AI and that the conversation is stored. We store your messages and the replies in our database (Supabase) and delete them after 90 days. We also store a hash of your IP address, the browser type, the language and the time. For the conversation we set a technically necessary cookie (“red-chat”, 24 hours) that holds only a random identifier. The legal basis is our legitimate interest in answering your questions and protecting against abuse (Art 6(1)(f) GDPR). To prevent abuse, Cloudflare Turnstile checks the first message and we limit the number of messages.

If you ask for contact in the chat, the assistant hands the conversation over to our office: the last messages of the conversation and, if you have given them, your name, email address and phone number are stored as an enquiry in our enquiry register and sent to the office by email (retention as for form enquiries, section 11). Sensitive data does not belong in the chat. The chat makes no decisions about you and does not replace advice.

8. Recipients and service providers

We pass on data only to recipients who need it for the stated purpose. They are bound to confidentiality by contract, law or professional rules.

• Vercel Inc. (USA): hosting and delivery of the website, Vercel Web Analytics. The server functions that process your form entries run in the Frankfurt am Main region (Germany). Vercel delivers pages, images and scripts through a worldwide network of locations, usually from the nearest one. According to Vercel, it is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition (Vercel DPA).
• Supabase Inc. (USA): database for the enquiry records, processor. The database is located in the EU (Ireland region). As the provider is based in the USA, access from the USA, for example for operations and support, cannot be ruled out. The European Commission's standard contractual clauses, which are part of Supabase's data processing agreement, apply (Supabase DPA).
• 1&1 IONOS SE (Germany): sending and receiving of emails through the office mailbox. We transmit the content of your enquiry by email to this mailbox; IONOS is a processor (email service) and processes the data in Germany.
• JustImmo (Austria): brokerage software, see section 6.
• Cloudflare, Inc. (USA): spam protection Turnstile in forms. The script loads only when a form becomes visible. Turnstile evaluates technical signals from your browser, such as IP address, TLS fingerprint, user agent and the requesting website, to detect automated access (Art 6(1)(f) GDPR). For spam protection Cloudflare is our processor; for improving its bot detection it is a controller in its own right. Details are in the Turnstile Privacy Addendum. According to Cloudflare, it is certified under the EU-US Data Privacy Framework.
• Google Ireland Limited (Ireland) and Google LLC (USA): Google Tag Manager and Google Analytics 4, only with your consent to statistics and analytics.
• Microsoft Ireland Operations Limited (Ireland) and Microsoft Corporation (USA): Microsoft Clarity, only with your consent to statistics and analytics.
• Tax advisers, accountants, lawyers, notaries, banks and property managers, where needed for a specific transaction or to meet legal duties.

9. Transfers to third countries

Some service providers are based in the USA or may process data there (Vercel, Supabase, Cloudflare, Google, Microsoft). We base the transfer on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified (according to their own statements Vercel, Cloudflare, Google and Microsoft), otherwise on the European Commission's standard contractual clauses (Supabase). For Google and Microsoft your consent applies in addition.

10. Statistics and analytics (only with consent)

On your first visit a banner asks which categories you allow. Until you decide, nothing from Google or Microsoft is loaded and no request is made to their servers. Your consent is stored for twelve months as the cookie “red-consent”. Under Cookies or through “Cookie settings” in the menu and in the footer you can change or withdraw your choice at any time. After a withdrawal we delete the cookies of these services and reload the page.

Statistics: Google Tag Manager and Google Analytics 4

With your consent we load Google Tag Manager, which controls Google Analytics 4. It measures page views, time on page, origin, device, approximate location and events such as opening a section, submitting a form or clicking “Call”. Events contain no names, addresses or message content. The data is processed by Google Ireland Limited and Google LLC. Under our setting Analytics keeps user-level event data for 14 months at most and then deletes it. We use Google Consent Mode: until you agree, all storage signals stay “denied”, and advertising signals stay denied afterwards as well. A link to Google Ads serves only to evaluate our ads.

Analytics: Microsoft Clarity

With the same consent we load Microsoft Clarity. Clarity records how visitors use a page (mouse movements, clicks, scrolling) and summarises this in session recordings and heatmaps. Forms are masked, their content does not enter the recording. The contracting party is Microsoft Ireland Operations Limited, which also transfers data to Microsoft Corporation (USA) based on standard contractual clauses; according to Microsoft, it is certified under the EU-US Data Privacy Framework. According to Microsoft, recordings are kept for 30 days, favourite recordings and a random sample for up to nine months; heatmaps are available for up to nine months (Clarity FAQ).

Cookies and storage

Which cookies and storage we use in detail, with name, purpose, duration and provider, is listed on the Cookies page.

11. How long we store data

• Entries in the enquiry records: deleted once the enquiry is closed and 180 days have passed since it was received.
• Emails about enquiries without a completed transaction in the office mailbox: 12 months after the last communication, then deleted.
• Chat conversations: 90 days.
• Guide link: valid for 7 days; the request itself is kept like any other enquiry.
• Contracts, invoices and accounting records: for tax reasons usually seven years (section 132 of the Austrian Federal Fiscal Code). For records concerning land the period can be twelve years, for certain properties up to 22 years (section 18(10) of the Austrian VAT Act). In pending tax or court proceedings we keep records beyond the period.
• Records under the anti-money-laundering rules: for the legally prescribed period after the end of the business relationship.
• Legal claims: where we need data to establish or defend legal claims, until the claims are time-barred. The periods follow from various laws and can be up to 30 years.
• Cookie consent: 12 months.

12. Do you have to provide data?

To answer your enquiry we need the details marked as required in the form. Without them we cannot process your enquiry or enter a contractual relationship. You can use the website without a form and without giving us any details.

13. Automated decisions

We do not use automated decision-making under Art 22 GDPR, neither to establish nor to carry out a business relationship.

14. Your rights

You have the right to:

• access to the data we process about you (Art 15 GDPR),
• rectification and erasure (Art 16 and 17 GDPR),
• restriction of processing (Art 18 GDPR),
• data portability (Art 20 GDPR),
• object to processing based on legitimate interest (Art 21 GDPR),
• withdraw consent with effect for the future (Art 7(3) GDPR).

If you think we violate your rights, please speak to us first so we can resolve it quickly. You can also complain to the supervisory authority: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

15. Security

Transmission between your browser and this website is encrypted with HTTPS. The enquiry records can only be accessed by the office through a password-protected login.

16. Changes

We adapt this policy when our processing changes. For forms we store which version you confirmed. The current version carries the date at the top of the page.