1. Controller and privacy contact
The controller is the HomeVergleich24 operator identified in the legal notice.
[Unternehmensname / legal company name] [Rechtsform / legal form] [Straße und Hausnummer / street address], [Postleitzahl / postcode] [Ort / city], Deutschland Privacy contact: info@homevergleich24.de
2. Website access and hosting
Technical connection information such as IP address, access time, requested URL, browser and device information is processed to deliver the website, diagnose faults and prevent abuse. The basis is Article 6(1)(f) GDPR and our interest in reliable, secure operation.
Hosting: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Regions: [Vercel-Region(en) / deployment regions]. Log retention: [Speicherdauer der Serverprotokolle / log retention]. Transfer safeguards: [Vereinbarte Drittlandgarantien / agreed transfer safeguards].
3. Solar and heat-pump enquiries
We process the contact and project details requested in your particular flow: salutation, name, email, phone, postcode and relevant information about property, ownership, roof, energy use, heating, timing and age. Not every flow requests every item. We also store the submission time, handling status and version of the legal acknowledgement.
We use this information to handle your referral request and find suitable contractors under Article 6(1)(b) GDPR. Required fields are necessary for the online enquiry process. Please do not include unnecessary or sensitive information in free-text fields.
The intended recipient category is up to three suitable solar or heat-pump contractors. We identify specific recipients and obtain necessary authorisation before sharing information. The form acknowledgement alone does not authorise indiscriminate sharing or general advertising calls. Contractors act as independent controllers for their offers.
4. Contact and partnership applications
Contact enquiries include name, email, phone and message. Partnership enquiries additionally include company and service area. We use these details to respond or assess a collaboration. Article 6(1)(b) GDPR applies to contractual enquiries; Article 6(1)(f) applies to other correspondence and contacts acting for a business, based on our interest in organised communication.
Acknowledging this privacy policy is not a separate consent to processing necessary for these purposes.
5. Optional partner updates
If you select the separate optional checkbox, we record your wish to receive HomeVergleich24 partner-network news by email. Such advertising is based on consent under Article 6(1)(a) GDPR. It is not required to submit a partnership enquiry.
You may withdraw consent through the privacy contact at any time for the future, without affecting prior lawful processing. The current website records the preference; automated newsletter delivery is not configured. [BEFORE SENDING: specify the email provider, confirmation process and unsubscribe method.]
6. Supabase storage and administration
Enquiries are stored in a Supabase database and handled by authorised staff in a protected administration area. Staff authentication also processes login details, session cookies and, where used, multi-factor authentication information. Access is subject to authorisation checks.
Supabase: [Supabase-Vertragspartner und Anschrift / contracted entity and address]. Region: [Supabase-Projektregion / project region]. Data protection agreements: [AV-Vertrag und Drittlandgarantien / processing agreement and transfer safeguards].
Supabase privacy information7. Automated abuse prevention
Public forms use Cloudflare Turnstile. Loading the check transmits technical browser, device and connection information to Cloudflare. Our server validates a short-lived security token before accepting an enquiry. We rely on Article 6(1)(f) GDPR for our interest in preventing automated and abusive submissions.
Cloudflare also processes certain Turnstile data as an independent controller. See its linked privacy addendum. [BEFORE PUBLICATION: assess the exact configuration, contracted entity, international safeguards and whether any device access is strictly necessary under section 25(2) TDDDG. Otherwise implement prior consent.]
Cloudflare Turnstile privacy addendum8. Optional phone verification
If phone verification is enabled and you request a code, Twilio processes your phone number, chosen channel and verification status to associate and protect your enquiry. The basis is Article 6(1)(f) GDPR. Verification is not marketing consent. The feature is disabled by default for launch.
SMS and, where offered and selected, WhatsApp are used for code delivery. WhatsApp involves its own service provider. [BEFORE ACTIVATION: specify contractual entities, processing locations, legal bases for optional channels, recipients, retention and transfer safeguards.]
Twilio privacy information9. Cookies, maps and external links
Unsubmitted enquiry drafts are held temporarily in page memory, not persistently in localStorage. A full reload clears them. The current language selection does not set a language cookie. Font files are served by this website.
Embedded Google Maps only loads when you choose “Load Google Maps”. This may transmit your IP address and device information to Google and use cookies or similar technologies, including processing in the US. The basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You may disable the map again; previous transfers cannot be reversed.
External links, including Instagram and Google Maps, only take you to those services when followed. The current source code contains no analytics or advertising pixels. Our cookies page provides further details.
Google privacy policy10. Retention and recipients
We keep enquiries for as long as needed to handle them, then delete information unless legal retention obligations or necessary legal claims require continued storage. Evidence is retained only to the extent needed.
Enquiries: [Löschfrist für Anfragen / enquiry retention]. Partner applications: [Löschfrist für Partnerbewerbungen / partner application retention]. Evidence: [Frist für Bestätigungsnachweise / acknowledgement evidence retention]. Backups: [Backup-Löschfrist / backup retention].
Recipients may include authorised staff, technical providers and the contractors described above. Authorities and legal advisers receive information only on an appropriate legal basis. Transfers outside the EEA must satisfy Articles 44 onwards GDPR. [SPECIFY: actual safeguards per provider and how to obtain a copy.]
11. Your rights
Subject to statutory conditions, you may request access, rectification, erasure, restriction and portability. You may withdraw consent for the future. You can object to processing based on legitimate interests for reasons relating to your particular situation, and object to direct marketing at any time.
Contact our privacy contact to exercise these rights. You may complain to a data protection authority, especially where you live, work or believe an infringement occurred. [Datenschutzaufsichtsbehörde mit Kontakt / data protection authority and contact]
The current enquiry process does not make solely automated decisions with legal or similarly significant effects.