Information on the processing of personal data on Immosearch.
Last updated: 23 Oct 2026.
The controller for the processing of personal data is AD immosearch e.U., owner Aldin Dacić, Antonie-Alt-Gasse 16, 1100 Wien, Österreich. You can find further information in the imprint.
You can submit data protection enquiries via the contact form on this website or by post to the above address.
We process personal data only to the extent necessary for operation, security, provision, improvement, communication, performance of contracts, abuse prevention or legal obligations.
Depending on use, in particular technical data, contact data, usage data, search data, enquiry data, account data, provider and company data, contract and invoice data, communication data, social media connection data as well as content that you or providers provide may be processed.
Personal data are processed for specified purposes and only to the extent necessary for the respective purpose. Access is restricted to the persons and functions required for this purpose.
The legal bases are in particular Art. 6(1)(b) GDPR for performance of a contract or pre-contractual measures, Art. 6(1)(f) GDPR for legitimate interests, Art. 6(1)(a) GDPR for consents, and Art. 6(1)(c) GDPR for legal obligations.
The website and database run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg. Hetzner processes the data on our behalf.
When the website is accessed, technical access data are processed: IP address, date and time, page accessed, referrer, browser type, operating system, technical status messages, data volume transmitted and security events.
These data serve technical provision, stability, error analysis, and the detection and prevention of misuse, attacks and automated accesses.
The legal basis is our legitimate interest in secure and functional operation pursuant to Art. 6(1)(f) GDPR.
We use necessary cookies and storage in the browser for the login session, the protection of forms, security, your cookie selection and display settings such as light/dark mode. Your cookie selection is stored for 180 days.
If you select the language of the website, we store your choice in the necessary cookie “im_lang” so that the website appears in this language on your next visit. Without your own selection we do not set this cookie; on your first visit we follow your browser’s language setting.
We do not set a cookie for visitor statistics (see Section 19). Optional marketing measurement with Meta is deactivated by default. Only after your consent to the “Marketing” category may Meta use cookies and similar storage (see Section 19a).
We only load external media such as Google Maps when you allow them in the cookie settings (see Section 18).
The legal basis for necessary storage is Section 165(3) TKG 2021 in conjunction with our legitimate interest in technical operation pursuant to Art. 6(1)(f) GDPR. For external media and optional marketing measurement, it is your consent pursuant to Art. 6(1)(a) GDPR; optional access to your browser only takes place with your consent under Section 165(3) TKG 2021. You can change or withdraw your selection at any time via in the footer.
For the property search, we process search terms, filters, sorting, selected page, number of results, search mode and technical session characteristics.
We use these data for the search function, to improve the quality of results, for error analysis and for protection against misuse or automated overloading. In the search log we store the IP address only in pseudonymised form as a hash value, not in plain text.
The search function is intended for property criteria. Please do not enter any sensitive or confidential personal data in search fields.
The legal basis is our legitimate interest in functional and protected search pursuant to Art. 6(1)(f) GDPR, or the performance of pre-contractual measures pursuant to Art. 6(1)(b) GDPR.
Immosearch offers AI-supported functions: the AI search, texts of the social media automation, and AI text editing in the Publisher. For this we use the AI service providers OpenAI and Anthropic.
AI search: Your search query is transmitted to the AI service provider so that search criteria can be generated from it. To protect against abuse and for cost control, we count AI searches per session and IP address; for this we store the IP address together with the search operation.
AI text editing in the social media publisher: If you use “Edit with AI” in the publisher, the post text you have chosen, the signature, the hashtags, your own request, and, for property posts, selected property details (title, location, price, rooms, living area, property and marketing type, link, property and location description without any contact details contained therein) are transmitted to the respectively active AI service provider. Only if you have the signature edited will name, company, telephone number and e-mail address from your profile additionally be transmitted so that the signature can be formed from them; internal identifiers and account data are not transmitted. Suggestions, your own requests and previous versions are stored for restoration for a maximum of 30 days; requests are counted per account for quota and cost control. When your account is deleted, these data are deleted.
Social media automation: For automated posts, property details of the respective real estate and your settings for the texts are transmitted to the AI service provider.
Translation of property texts: We have the title, description, features and location details of a property translated by an AI service provider into the languages of the website and store the translation. The texts originate from the provider of the property. We replace contact details in the texts (email, web address, telephone number, name of the contact person) with placeholders before transmission, insofar as they are automatically recognisable. The AI service provider processes the texts on our behalf as a processor.
AI functions are solely for support. They do not make legally binding decisions about users and do not replace your own review. Please do not enter sensitive data into AI or search fields.
Depending on the function, the legal basis is the performance of a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR, or our legitimate interest pursuant to Art. 6(1)(f) GDPR. For transfers to the USA, see Section 22.
If you send an enquiry via the general contact form or via a property form, we process the data you provide, in particular salutation, first name, last name, email address, telephone number, company, subject, message and your consent to privacy policy and terms of use.
If you are logged in, you can additionally send details from your profile with property enquiries, such as address, date of birth, your tenant or buyer profile and your profile picture. Only what you select for this purpose is transmitted.
For property enquiries, the following are additionally processed: property reference, provider or estate agent assignment, time of enquiry, IP address, user agent, referrer, enquiry path, spam and security characteristics, processing status and forwarding status.
These data are processed so that the request can be handled, assigned, forwarded, documented and protected against misuse.
Messages sent via the general contact form are, in addition to the e-mail to us, stored in our system (name, company, e-mail address, telephone number, subject, message, time, IP address and technical details of the browser) so that they are not lost and can be processed in a traceable manner even in the event of a disruption to e-mail delivery. They are not forwarded to providers and are retained in the same manner as property enquiries.
The legal bases are pre-contractual measures pursuant to Art. 6(1)(b) GDPR and our legitimate interest in orderly processing and demonstrability pursuant to Art. 6(1)(f) GDPR.
Translation of requests: If you use the website in a language other than German, we will have the text of your property or profile enquiry translated into German for our team by an AI service provider. We replace name, email address, telephone number and other contact details with placeholders before transmission. The legal basis is the performance of your request (Art. 6(1)(b) GDPR).
Property enquiries are forwarded to the responsible provider, estate agent, property developer or property management company, as a rule by e-mail.
If the provider has connected its CRM (for example Justimmo or onOffice) with Immosearch, the enquiry may additionally be transmitted as technical feedback to this system.
The provider subsequently processes the data under its own responsibility, in particular to answer your enquiry, to coordinate viewings, or to provide further information on the property. Please also take note of its privacy information.
We cannot guarantee a response by the provider.
The provider always receives only your original message.
If you create a user account or log in, we process name, email address, password hash, login times, session data, IP address, user role, account status, email verification status and security logs.
The language in which you use the website during registration will be adopted as the language of your account; you can change it in the profile.
During registration we also store when you accepted which version of the terms of use and this privacy policy in which language. After an account deletion, only the time, version and language remain without any personal reference.
If you log in with Google, we receive from Google your name, your email address, the confirmation of this address and, where applicable, your profile picture. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Passwords are not stored in plain text, but as a password hash. Session data serve to recognise logged-in users and to provide the protected area.
The legal bases are performance of a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR as well as our legitimate interest in secure account operation and in the demonstrability of consent pursuant to Art. 6(1)(f) GDPR.
If you use these functions, we process saved properties, search profiles, filter criteria, notification settings, your email address, as well as dispatch and error status of the notifications.
This processing serves the personal use of the portal and the notification of suitable properties or changes.
You can deactivate these functions at any time and delete stored entries.
For provider, estate agent and business accounts, we process company data, contact persons, roles and permissions, employee accounts, contact details, login and security data, package status, usage data and, in the case of paid services, contract and invoice data.
These data serve the administration of professional users, the provision of business and SaaS functions, support, billing, security and the traceability of changes.
Employee accounts may be assigned to a company or provider profile. Depending on the authorisation, internal users may access listings, enquiries, social media functions, package data or other business functions.
The legal bases are performance of a contract pursuant to Art. 6(1)(b) GDPR, legal obligations pursuant to Art. 6(1)(c) GDPR, and legitimate interests pursuant to Art. 6(1)(f) GDPR.
Immosearch processes property, provider, media and contact data from connected interfaces and property software (for example Justimmo and onOffice), from XML files and other import methods.
These include property data, prices, areas, addresses, photos, plans, documents, energy performance certificates, provider information, and contact details of contact persons.
The purpose is the publication, presentation, updating, allocation, forwarding of enquiries and technical administration of the real estate listings. Responsibility for the data provided lies with the respective provider.
Depending on the package, Immosearch offers functions for the preparation, planning and publication of social media posts.
In the process, we process connected platform accounts, user identifiers of the platforms, page and profile information, permissions, access tokens, post contents, images, property reference, time and status of publication, error status, platform links, and technical logs.
Supported platforms are Facebook and Instagram (Meta Platforms Ireland Limited), LinkedIn (LinkedIn Ireland Unlimited Company), X (Twitter International Unlimited Company) and Pinterest (Pinterest Europe Limited). The connection and publisher data described here are received by these platforms only if you connect an account or publish a post. For separate voluntary marketing measurement with Meta, see Section 19a. Their privacy policies apply to their own processing.
If a post contains an Immosearch link, we count clicks on this link: time, platform, referrer page, browser identifier, a hash value of the IP address and a bot detection. For one hour your session remembers via which link you arrived. This allows providers to see how their posts are performing. The legal basis is the legitimate interest pursuant to Art. 6(1)(f) GDPR.
The publisher offers AI text editing (see Section 6). AI suggestions are assistance: you decide whether and in what version a post is published, and you remain responsible for the content.
You can disconnect connections in your account at any time.
For social media functions, a connection to Meta/Facebook may be established. In doing so, Meta user IDs, page data, page images, permissions, access tokens, post contents, publication status and Facebook links are processed and stored server-side.
The processing serves the administration and publication of posts on associated pages or profiles.
The processing by Meta is additionally subject to Meta’s data protection provisions and platform terms.
How you can have your data connected via Facebook deleted by us is set out at www.immosearch.eu/facebook-data-deletion.
You can also connect an Instagram professional account (Business or Creator) directly via the Instagram login, without a Facebook page. The provider is Meta Platforms Ireland Limited.
We use the connection to publish posts on your Instagram account on your behalf and to display your account and posts in Immosearch.
In the process, we process: Instagram username, account ID, account type, profile picture, number of followers and posts, the permissions granted, an access token with an expiry date (up to 60 days), as well as the posts published via Immosearch with text, images, time, and Instagram media ID.
The legal basis is the performance of the contract concerning the social media tool (Art. 6(1)(b) GDPR).
If you disconnect the connection in Immosearch or remove Immosearch in your Instagram settings, we will delete the access token immediately. We will delete the user name, profile picture, follower and key metrics as soon as you request the deletion of your data via Instagram (you will receive a confirmation code and a status address) or delete your Immosearch account. We retain the account ID and post history as proof of your publications.
Posts published via Immosearch remain on Instagram. Instagram does not allow deletion via this connection; you can delete them at any time in the Instagram app.
The processing by Meta is subject to the Instagram Data Policy and Meta’s platform terms.
You can connect an Instagram professional account (Business or Creator) directly via Instagram Login. We use the connection only to publish posts to your account on your behalf and to show you your account and posts in Immosearch.
Data: Instagram username, account ID, account type, profile picture, follower and media count, granted permissions, an access token with expiry (up to 60 days), and the posts you publish through Immosearch (text, images, time, Instagram media ID). Legal basis: performance of contract (Art. 6(1)(b) GDPR).
If you disconnect in Immosearch or remove Immosearch in your Instagram settings, we delete the access token immediately. If you request data deletion through Instagram or delete your Immosearch account, we also delete your username, profile picture, follower count and metrics; a data deletion request returns a confirmation code and a status link. Account ID and post history are kept as proof of publication.
Posts stay on Instagram. Instagram does not support deleting them through this connection; you can delete them in the Instagram app at any time. Questions: contact form on immosearch.eu.
We process payments for paid packages via Stripe: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.
You enter card data and other means-of-payment data directly with Stripe; we do not receive them. We store the booked package, term, subscription and payment status, invoices, invoice name, company, invoice address and tax details such as the VAT ID number.
This processing serves the purposes of contract execution, invoicing, accounting and the fulfilment of statutory retention obligations. Stripe may also process data in the USA (see Section 22).
The legal bases are performance of a contract pursuant to Art. 6(1)(b) GDPR, legal obligations pursuant to Art. 6(1)(c) GDPR, and legitimate interests in proper processing pursuant to Art. 6(1)(f) GDPR.
If you contact us or request support, we process messages, support requests, problem descriptions, screenshots or attachments, processing status and internal notes.
The purpose is the processing of your enquiry, troubleshooting, documentation, security and improvement of our services.
Please do not transmit any sensitive data unless this is necessary for processing.
Depending on the content, the legal bases are pre-contractual or contractual measures pursuant to Art. 6(1)(b) GDPR, legitimate interests pursuant to Art. 6(1)(f) GDPR, or legal obligations pursuant to Art. 6(1)(c) GDPR.
Immosearch sends emails, for example for contact enquiries, registration, email verification, password reset, search profile notifications, security notifications and social media status messages.
For dispatch we use an e-mail service provider. In doing so, the contents and recipient details required for dispatch as well as dispatch and error status are processed.
The purpose is communication, portal operation, contract processing and security.
During the free trial period and after a purchase, we will send you emails regarding your contract: confirmation of the start of the trial period, notification that the trial period has ended, a welcome email after the purchase of Pro or Ultimate, and a confirmation when you cancel your subscription. The legal basis is Art. 6(1)(b) GDPR.
As an existing customer you will also receive emails about our own, similar services: reminders 7, 3 and 1 days before the end of the trial period, a one-time discount code 3 days after the end if you do not have a subscription at that point, as well as, after the purchase of Pro or Ultimate, “First steps” after 3 days and “Tips” after 14 days. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 174(4) TKG 2021 (exception for existing customers).
You may object to these promotional emails at any time – under Settings › Notifications or via the link in each of these emails. You will still receive the emails relating to your contract.
We log the sending of these emails without address, subject or content (campaign, step, status and times).
Fonts: The fonts are hosted on our own server. When loading the website, no connection is established to Google Fonts or other font providers.
Maps: On property pages, a Google Maps map can be displayed. It is only loaded when you allow “External media” in the cookie settings; Google then receives your IP address and technical data. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.
Links to social media platforms are normal links. Only when you open them do you leave Immosearch, and the data protection provisions of the respective platform apply.
We provide preview images (OpenGraph) so that links to Immosearch are displayed correctly in messengers and social networks.
We count visits with our own statistics on our server, without a cookie and without third-party providers.
For guests, we generate a hash value from the IP address and browser identifier, which is recalculated every day. Visits on different days cannot therefore be linked; we do not store the IP address itself for this purpose. For logged-in users, we assign page views and clicks to the account.
Pages viewed, clicks, time, referring page, device type and browser are stored. The purpose is the improvement of the portal.
The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. You can object at any time: switch off “Statistics” in the cookie settings or select “Only necessary”. After that, you will no longer be counted.
Our own visitor statistics are separate from the voluntary Meta marketing measurement (Section 19a).
If you allow marketing in the cookie settings and the measurement function is enabled, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This allows us to measure whether our advertising leads to page visits, completed registrations or a first activation of the social media automation.
In the process, technical data such as IP address, browser and device information, cookies or comparable identifiers, time and type of event, as well as the address of the shared public page may be transmitted to Meta. Meta may link the data to a Facebook or Instagram account and process it for advertising in accordance with its privacy information. We do not send any additional contact fields such as e-mail address or telephone number and do not use extended automatic matching.
The measurement runs only on selected public pages and a neutral success page. On account, administration and confirmation pages with private data, we do not load the Meta Pixel. Internal account identifiers, form contents and private return addresses are not part of our measurement events.
Insofar as Meta sets the cookies _fbp (browser identifier) or _fbc (assignment of an ad click), Meta states a duration of 90 days in each case. Your browser may limit this duration. For transmitted event data, Meta’s Business Tools Terms provide for storage of no more than two years; this is to be distinguished from the cookie duration.
For the collection and transmission of event data for advertising measurement and personalisation, we and Meta are joint controllers, insofar as the Supplementary Agreement at https://www.facebook.com/legal/controller_addendum applies. In particular, we are responsible for providing information on our website and obtaining your consent. Meta enables the exercise of the rights under Art. 15 to 20 GDPR with regard to the data stored by Meta. You may contact Meta or us for this purpose; requests addressed to us that concern Meta will be forwarded in accordance with the agreement. The subsequent processing by Meta is carried out under its own responsibility.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, for optional storage accesses, § 165(3) TKG 2021. Marketing is voluntary; refusing does not impair the use of Immosearch. You can withdraw your consent at any time with effect for the future via “cookie settings” in the footer. Data already transmitted will not thereby be automatically deleted by Meta.
You can find Meta’s privacy information at https://www.facebook.com/privacy/policy/ and information on cookies at https://www.facebook.com/privacy/policies/cookies/. For transfers to third countries see Section 22.
In the admin area, login and session data, admin actions, change logs, security logs, as well as access to enquiries, listings, providers, users and interfaces are processed.
This processing serves the purposes of administration, security, traceability, troubleshooting, support and the prevention of abuse. Access to the admin area is restricted to authorised persons.
The legal basis is our legitimate interest in secure and traceable platform operation pursuant to Art. 6(1)(f) GDPR, as well as, where applicable, performance of a contract or legal obligations.
Depending on use, personal data are received by: Hetzner (hosting), our email service provider (dispatch), Stripe (payments), OpenAI and Anthropic (AI functions), Google (login, maps), Meta (in the case of connected social use as well as in the case of voluntary marketing consent), LinkedIn, X and Pinterest (in the case of connected accounts and publications), providers and estate agents together with their CRM (in the case of enquiries), our tax advisers as well as authorities, insofar as we are obliged to do so.
Disclosure only takes place insofar as this is necessary for the respective purpose, a legal basis exists or a statutory obligation applies.
Some service providers also process data outside the EU, in particular in the USA: OpenAI, Anthropic, Google, Meta, LinkedIn, X, Pinterest and Stripe.
The transfer is based on the adequacy decision of the European Commission for certified companies (EU-US Data Privacy Framework) or on the European Commission’s standard contractual clauses.
We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist. In particular, the following applies:
User account: until deletion by you; thereafter it is anonymised. The time, version and language of the consent to the terms of use and privacy policy remain preserved without any personal reference.
Social media: Suggestions and previous versions of the AI text editing for a maximum of 30 days; drafts in the publisher expire after 30 days. Of the image copies of a post, only a small preview image remains one day after completion.
Cookie selection: 180 days. Language selection (cookie “im_lang”): 365 days. Visitor statistics: The hash value for guests changes daily.
Marketing: For the one-time transfer of a conversion we store internally for a short time the account reference, event type, hashed one-time codes and timestamps. A prepared transfer can be used for at most 24 hours, a confirmed one for at most 120 seconds and never longer than the original deadline. Consumed transfers are deleted. Expired rows are removed on an ad hoc basis in limited quantities upon deregistration or account change; without further cause they may be stored longer, but are no longer usable. When the account is deleted, we remove these transfer data. If database deletion fails upon deregistration, the original expiry period remains; you can still deregister. For processing and storage duration at Meta, its linked privacy and cookie information apply.
Contact and property enquiries: for as long as is necessary for processing, evidence, and the defence or enforcement of claims; upon justified request they are anonymised.
Translation of a request: for as long as the request; it will be anonymised together with it.
Invoicing and accounting data: seven years pursuant to § 132 BAO.
Dispatch log of emails for the trial phase and after a purchase: until the deletion of the account; thereafter it remains without personal reference on the anonymised account.
Subject to the statutory provisions, you have the right of access, rectification, erasure, restriction of processing, data portability, as well as to object to processing based on legitimate interests.
You may withdraw consent at any time with effect for the future. The lawfulness of processing up to the time of withdrawal remains unaffected.
You may object to processing for direct marketing at any time without stating reasons (Art. 21(2) GDPR).
You may lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority.
To exercise your rights, please use the contact form on this website or write to our postal address. In order to process your request, it may be necessary to verify your identity.
We protect personal data with appropriate technical and organisational measures, including access restrictions, HTTPS encryption, password hashing, role and permission systems, logging, protection against abuse and automated attacks, as well as backups.
Access to personal data is internally restricted to persons and functions that require this data for operation, support, security or performance of contracts.
No one can guarantee absolute security in electronic data processing.
We adapt this privacy policy if functions, technical processes, service providers used or legal requirements change.
In the event of material changes, we inform registered users insofar as this is necessary. The date above shows which version applies.