Privacy Policy

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2. Scope and general information

This privacy policy applies to the websites https://bellazzura.com and https://bellazzura.de as well as their respective www variants, insofar as these redirect to this website or provide its content. It also applies to our business profile on Instagram (@bellazzura.immo, section 10b).

Protecting your personal data matters to us. Personal data is any data that can be used to identify you personally. This policy explains which data we process when you visit this website and when you contact us, for what purposes, and what rights you have.

3. Hosting

This website is hosted by STRATO GmbH.

When you access this website, STRATO processes, on our behalf, technical data required for providing, stabilising and securing the website. This may include in particular:

• IP address of the accessing device,
• date and time of access,
• page or file requested,
• referrer URL,
• browser type and version,
• operating system,
• host name or technical access identifiers,
• HTTP status code and volume of data transferred.

STRATO stores the full IP address for no more than seven days in order to detect and prevent attacks; after that it is anonymised. We only have access to log files with anonymised IP addresses and for no more than six weeks.

Processing is based on Article 6 (1) (f) GDPR. Our legitimate interest lies in the secure, uninterrupted and technically reliable provision of this website and in preventing attacks and misuse.

Insofar as STRATO processes personal data on our behalf, this is done under a data processing agreement pursuant to Article 28 GDPR. The servers are located in Germany.

4. TLS/SSL encryption

For security reasons and to protect the transmission of confidential content, this website uses TLS/SSL encryption. You can recognise an encrypted connection by the browser address bar beginning with “https://” and by the padlock symbol.

5. Fonts, images and video

This website uses the typefaces Playfair Display and Lato. Both are delivered locally from our own web space at STRATO. No connection to Google Fonts or any other external font or content delivery service is established, and no data is transferred to third parties for this purpose.

All images and video content are delivered from our own web space. No image, video or stock-photo service is embedded, and no data is transferred to such providers when you visit this website.

6. Program libraries

The animations on this website use the JavaScript libraries GSAP and Lenis. Both are delivered locally from our own web space. No connection to an external content delivery network is established.

7. Language selection in local storage

This website is available in German, English and Turkish. When you choose a language, your selection is stored in your browser's local storage under the key “bellazzura-lang” so that the site opens in your preferred language on your next visit. This entry contains only the value “de”, “en” or “tr”, no personal data, and it is not transferred to us or to any third party. Access to your device is based on Section 25 (2) of the German TDDDG, as it is necessary to provide a function you expressly requested. You can delete the entry at any time via your browser settings.

8. Cookies and similar technologies

We use technically necessary technologies without consent insofar as they are required to provide the website. These include storing your language selection (section 7) and your consent decision. The legal basis for access to your device is Section 25 (2) TDDDG; for any associated processing of personal data, Article 6 (1) (f) GDPR.

We use analytics and marketing services (sections 8b and 8c) only if you have agreed via our consent banner. The legal basis is then Section 25 (1) TDDDG in conjunction with Article 6 (1) (a) GDPR. Without consent, these services are not loaded.

8a. Consent management

We store your decision in the consent banner in your browser’s local storage under the key “bellazzura-consent” (selected categories and time). This entry is not transferred to us or third parties and is requested again after twelve months. You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer. The banner is our own solution; no external provider is involved.

8b. Google Analytics 4

With your consent to the “Statistics” category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics stores cookies (in particular “_ga”, lifetime up to two years) and processes pseudonymous usage data such as pages viewed, time on site, device type, approximate region and events such as submitting the contact form with the selected type of enquiry or clicks on phone, email and WhatsApp links. The content of your enquiry, your name and your contact details are not transmitted to Google. The purpose is to analyse and improve our website and to measure the success of advertising. Google processes the data on our behalf under the Google Ads Data Processing Terms (Article 28 GDPR). We have disabled the sharing of Analytics data with Google for other purposes. Event and user data are deleted after two months. Google may also transfer data to Google LLC in the USA (see section 13). Further information: policies.google.com/privacy.

8c. Meta Pixel

With your consent to the “Marketing” category, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). The pixel stores cookies (in particular “_fbp”, lifetime three months) and transmits page views and the events “Lead” (submitting the contact form with the type of enquiry) and “Contact” (click on phone, email or WhatsApp) to Meta. This allows us to measure whether our advertising on Facebook and Instagram leads to enquiries and to show advertising to people who have shown interest in our services. The content of your enquiry, your name and your contact details are not transmitted to Meta. We and Meta are joint controllers for the collection and transmission (Article 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. We have no influence on how long Meta stores the data; this is governed by Meta's privacy policy. Meta may also transfer data to Meta Platforms, Inc. in the USA (see section 13). Further information: facebook.com/privacy/policy.

8d. Counting enquiries and contact clicks

When you submit the contact form, our web server at STRATO counts the type of enquiry on receipt. Only the date, time and type of enquiry are stored, no IP address and no content. Insofar as personal data is affected at all, the legal basis is Article 6 (1) (f) GDPR; our legitimate interest lies in planning our services.

We only count clicks on phone, email and WhatsApp links if you have consented to statistics. On the click, your browser sends a short message to our web server; only the date, time and type of link are stored. The legal basis is your consent (Section 25 (1) TDDDG, Article 6 (1) (a) GDPR), which you can withdraw at any time via the cookie settings.

9. Contact by email and telephone

If you contact us by email or telephone, we process the data you provide, in particular your email address, your name, your telephone number, the content of your message and any further information you volunteer.

The processing serves to handle and answer your enquiry. The legal basis is Article 6 (1) (b) GDPR where your enquiry relates to the conclusion or performance of a contract. In all other cases, processing is based on Article 6 (1) (f) GDPR; our legitimate interest lies in dealing with enquiries properly. Where you have given us consent, Article 6 (1) (a) GDPR is the legal basis.

We retain your enquiry for as long as necessary to deal with it. We then delete the data, at the latest after the periods stated in section 12, unless statutory retention obligations apply.

10. Contact form and CRM

If you write to us via the contact form (including on the “Sell” and “Search Mandate” pages), we process the data you provide: name, email address, telephone number (optional), your subject and your message and, where you provide them, country, town or region, property type, intended use (owner occupation, holiday home or investment), budget or price expectation and timeframe; for investment enquiries also target yield and equity share, and for commercial space searches company, type of space, size and whether you wish to rent or buy. If you open the form from a property page, the name of that property is also transmitted (property reference). To protect against automated enquiries, the form also transmits the time at which the page was loaded and a field that is invisible to people; both are only checked and are not passed on in the email. The purpose is to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries. The details are transmitted as an email to our mailbox by a script on the servers of our hosting provider STRATO GmbH in Germany and are not stored in a database on the web server; only the type of enquiry is counted (section 8d). The contact form is not connected to a CRM system; if we continue to handle your enquiry, we enter your details manually in our CRM system (see below). We delete the data once the enquiry has been fully dealt with, at the latest after the periods stated in section 12, unless statutory retention obligations apply. Name, email address, subject and message are required to handle your enquiry, and for commercial space searches also company, type of space, size and whether you wish to rent or buy; without them we cannot respond. All other details are voluntary and help us to answer your enquiry in a targeted way.

Client management (CRM): Enquiries that reach us via the contact form, by email, by telephone, via WhatsApp, Instagram or property portals and that we continue to handle are entered manually in our CRM system HubSpot, in particular name, contact details, request, property reference, source of the enquiry, appointments and consents given. There is no automatic transfer. The provider is HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA; an EU data region has been set up for our account. HubSpot processes the data as a processor under Article 28 GDPR on the basis of the data processing agreement incorporated into the customer terms. HubSpot's AI features, the use of our data to train AI models and access by HubSpot support are disabled. As estate agents, we are obliged under the German Money Laundering Act to identify the parties to a transaction brokered by us as soon as there is a serious interest in carrying it out, and to record their name, place and date of birth, nationality and address (sections 2 (1) no. 14, 11 and 8 GwG); the legal basis is Art. 6 (1) (c) GDPR. We do not store identity documents, proof of financing or other documents in HubSpot, but exclusively in our cloud storage STRATO HiDrive in Germany. The legal basis is Art. 6(1)(b) GDPR where a contract or pre-contractual measures are concerned, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in the orderly and traceable handling of our prospective and existing clients. For the retention period see section 12, for possible access from the USA section 13.

10a. Contact via WhatsApp

Our website offers a link for contacting us via WhatsApp. WhatsApp is a service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a Meta group company. The link is a simple hyperlink; no data is transmitted to WhatsApp and no WhatsApp content is loaded when you visit our website. Only when you click the link are you forwarded to WhatsApp, where WhatsApp's privacy policy applies. If you write to us via WhatsApp, we process your telephone number, your name and profile name and the content of your messages in order to answer your enquiry. We use WhatsApp Business on a separate company device; the app has no access to an address book. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR. WhatsApp may also transfer data to the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, and standard contractual clauses are used in addition. Use is voluntary; you can also reach us at any time via the contact form, by email or by telephone. Further information: www.whatsapp.com/legal/privacy-policy-eea.

10b. Our Instagram profile

We operate the business profile @bellazzura.immo on Instagram to present our company and our services and to get in touch with prospective and existing clients. Instagram is a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). When you visit our profile, Meta processes your data under its own terms, in particular your IP address, device and usage data and, if you are logged in, data from your Instagram account. We have no influence over this processing. Further information: privacycenter.instagram.com/policy.

Statistics (Insights): As a business account, we receive aggregated statistics from Meta on the use of our profile, for example reach, interactions and the origin, age and gender of visitors in non-personal form. We and Meta are joint controllers for the processing used to create these statistics (Article 26 GDPR). Under the joint controller agreement, Meta has assumed primary responsibility for this processing and in particular fulfils the information obligations and handles requests from data subjects; the agreement is available at facebook.com/legal/terms/page_controller_addendum. The legal basis is our legitimate interest in presenting our company in a contemporary way and in reaching prospective clients effectively (Art. 6(1)(f) GDPR).

Comments, mentions and direct messages: If you comment on our posts, mention us or send us a direct message, we process your user and profile name, your profile picture, the content of your messages and the information you provide, such as contact details or details of a property, in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR. If your enquiry results in a brokerage mandate, we transfer the necessary details to our client management system (section 10). Direct messages are stored on Meta's servers; Meta can access their content. Please do not send us identity documents, financial records or other particularly sensitive documents via Instagram; we will agree another channel with you for these. Use is voluntary; you can also reach us at any time via the contact form, by email or by telephone.

Retention and your rights: We delete direct messages and comments once your enquiry has been dealt with, at the latest after the periods stated in section 12, unless statutory retention obligations apply. We have no influence over how long Meta stores data. Meta may also transfer data to the USA (section 13). You can assert your rights (sections 14 and 15) against us and against Meta; requests concerning the statistics are most effectively addressed directly to Meta: help.meta.com/support/privacy. If you contact us, we will forward your request to Meta where necessary.

10c. Newsletter

If you sign up for our newsletter on our website, we process your email address, the interests you choose voluntarily and your chosen language in order to send you market reports and selected property offers by email about four times a year. The legal basis is your consent (Art. 6(1)(a) GDPR; for email advertising Section 7(2) No. 2 of the German Unfair Competition Act, UWG). Providing your email address is required to receive the newsletter; receiving it is independent of our other services.

Confirmation (double opt-in): After signing up you will receive an email with a confirmation link. We only add you to the mailing list once you have confirmed your subscription with it. To be able to prove your consent (Art. 7(1) GDPR), we store the time and IP address of the sign-up and of the confirmation as well as the wording of the consent; the legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. The sign-up data is stored on the servers of STRATO GmbH in Germany. We delete unconfirmed sign-ups after 7 days; the confirmation link is valid for 72 hours.

Sending and analysis: We transfer confirmed sign-ups manually to our CRM system HubSpot (section 10) and send the newsletter from there. In doing so, it is recorded whether an issue was opened and which links were clicked. We use this information only to improve content and sending times; this analysis is part of your consent. For possible access from the USA see section 13.

Withdrawal: You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by email to hello@bellazzura.com. The lawfulness of the processing carried out until then remains unaffected. After you unsubscribe, we remove your address from the mailing list; in HubSpot it remains blocked as unsubscribed so that you do not receive any further issues. We keep the proof of your consent for up to three years after the end of your subscription in order to be able to defend ourselves against possible claims (Art. 6(1)(f) GDPR).

11. Recipients of personal data

We only pass on personal data where this is permitted by law, where you have consented, where it is necessary to perform a contract, or where we engage service providers as processors. Recipients may in particular be STRATO GmbH as our hosting, email and cloud storage provider (HiDrive), HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA (CRM system; processing on our behalf on the basis of the data processing agreement incorporated into the customer terms; an EU data region has been set up for the account; section 10), sevDesk GmbH, Im Unteren Angel 1, 77652 Offenburg, Germany (accounting and invoicing; processing on our behalf under Article 28 GDPR; processing generally within the EU or the EEA), Google Ireland Limited and Meta Platforms Ireland Limited (only with your consent, sections 8b and 8c, and as operator of Instagram, section 10b), WhatsApp Ireland Limited (if you contact us via WhatsApp, section 10a), licensed partner offices, notaries and other parties involved in transactions abroad (section 11a), as well as authorities, courts, tax advisers or legal advisers, insofar as this is necessary or required by law.

11a. Transfer to partners and notaries abroad

If you instruct us to search for, buy or sell a property outside Germany, we work with licensed local partner offices as well as with notaries, land registries (in Türkiye the Tapu directorates), valuers, translators, banks and financing partners. For this purpose we transfer the data required in each case, such as name, contact details, passport or ID data, tax number and information on the property, financing and payment. Recipients may be located in EU member states, Monaco and Türkiye. The legal basis is Article 6 (1) (b) GDPR (pre-contractual measures and performance of the contract with you) and, where legal obligations apply, Article 6 (1) (c) GDPR.

There is no adequacy decision of the European Commission for Türkiye and Monaco (Article 45 GDPR); a level of data protection equivalent to EU law is not guaranteed there. Transfers to these countries take place insofar as they are necessary for the performance of the contract with you or for pre-contractual measures taken at your request (Article 49 (1) (b) GDPR). We agree confidentiality and compliance with data protection with our partner offices; in Türkiye the recipients are also subject to the Turkish Data Protection Law KVKK (Law No. 6698).

12. Retention period

We store personal data only for as long as necessary for the respective purpose: enquiries without a subsequent brokerage contract for up to 12 months after the last contact; contract and transaction documents in accordance with statutory retention periods (business letters 6 years, accounting records 8 years, books and annual financial statements 10 years, Section 257 HGB, Section 147 AO); identification records under the Money Laundering Act 5 years from the end of the calendar year in which the business relationship ends or the transaction is completed (section 8 (4) GwG). Newsletter: for as long as you receive it, unconfirmed sign-ups 7 days, proof of consent up to three years after the end of the subscription (section 10c). Server log files at STRATO: full IP address for no more than seven days, anonymised thereafter (section 3). Google Analytics: event and user data for two months (section 8b). The consent decision in local storage is requested again after 12 months. We then delete the data.

13. Data processing outside the European Union

Apart from the cases described in this section and in section 11a, we do not transfer personal data to countries outside the European Union or the European Economic Area; this website is hosted in Germany. If you contact us via WhatsApp (section 10a) or use our Instagram profile (section 10b), data may be transferred to Meta Platforms, Inc. in the USA. If you consent to Google Analytics (section 8b) or the Meta Pixel (section 8c), data may be transferred to Google LLC or Meta Platforms, Inc. in the USA. Both companies are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Article 45 GDPR); standard contractual clauses are used in addition. When HubSpot is used, access by HubSpot, Inc. in the USA and by the sub-processors it engages is possible despite the EU data region that has been set up. Insofar as the respective US recipient is validly certified under the EU-US Data Privacy Framework and the specific processing is covered by the certification, the transfer is based on the European Commission's adequacy decision under Article 45 GDPR. Otherwise, the EU standard contractual clauses incorporated into the HubSpot data processing agreement are used as the transfer mechanism under Article 46 GDPR. Further information on the transfer safeguards can be requested from us. Should further service providers outside the EU/EEA be engaged, we will provide information about this and ensure appropriate safeguards pursuant to Articles 44 et seq. GDPR.

14. Your rights

Subject to the statutory requirements, you have in particular the following rights:

• right of access pursuant to Article 15 GDPR,
• right to rectification pursuant to Article 16 GDPR,
• right to erasure pursuant to Article 17 GDPR,
• right to restriction of processing pursuant to Article 18 GDPR,
• right to data portability pursuant to Article 20 GDPR,
• right to object pursuant to Article 21 GDPR,
• right to withdraw consent with future effect pursuant to Article 7 (3) GDPR,
• right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR.

Competent data protection supervisory authority:

We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.

15. Right to object

Where we process personal data on the basis of Article 6 (1) (f) GDPR, you have the right under Article 21 GDPR to object at any time to such processing on grounds relating to your particular situation.

Please address your objection to: hello@bellazzura.com

16. Currency of this policy

This privacy policy is dated 21 October 2026. We will adapt it whenever our website, the services used or legal requirements change.