Privacy notice

Hamed Ghayour Mobarhan

Hamed Ghayour Baufinanzierung

Kutschergasse 3

67346 Speyer

Telefon: 0174 9188476

E-Mail: hamed@finanzierung-speyer.de

No data protection officer has been appointed, as the legal requirements for a mandatory appointment are not met.

The website is provided and delivered via Lovable's infrastructure on the basis of a data processing agreement pursuant to Art. 28 GDPR. Lovable in turn uses sub-processors (for hosting, content delivery and operational security, among others) in accordance with its current sub-processor list.

When the website is accessed, technically necessary access data is processed, in particular: IP address, time of access, requested URL, browser/user-agent information, referrer as well as request and error data.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure, stable and error-free operation of the website and in preventing misuse.

No separate fixed retention period is documented for these server and access logs. Storage takes place only to the extent and for as long as necessary for operation, security and error analysis, or as specified by the processor.

Where processing outside the EU/EEA occurs as part of this hosting, it is based on the safeguards set out in the Lovable DPA, in particular the EU standard contractual clauses under Art. 46 GDPR or an adequacy decision where applicable to the respective recipient. The current Lovable DPA and its linked sub-processor list are decisive.

The fonts used, „Cormorant Garamond“ and „Jost“, are served entirely locally from this website.

There is no connection to any external font provider; no data is transmitted to third parties when the fonts are loaded.

The active website code uses no consent-requiring cookies and no tracking technologies. No web analytics or tag management services, advertising or social media pixels, website trackers, fingerprinting technologies or marketing cookies are used. A cookie banner is therefore not required.

Only technically necessary functions within the meaning of Sec. 25(2) no. 2 TDDDG are used. No consent is required for this.

Should optional services be integrated in the future, this will only happen after your explicit consent (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future.

If you contact me by telephone, I process the information you provide (in particular name, telephone number and the content of your enquiry) in order to handle your request. Calls are not recorded.

If you contact me by email, I process your email address and the content of your message including the technical metadata of the email in order to handle your request.

The purpose is handling your enquiry and, where applicable, taking pre-contractual steps. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (interest in responding to enquiries).

No consent is obtained or required for this communication.

The contact form processes only: name, telephone number (if provided), email address (if provided), topic of your enquiry, optional message, and the date and time of the request.

Mandatory information is your name, the topic and at least one means of contact (telephone number or email address). Without this information the request cannot be processed.

The form does not ask for financial or bank account data, ID or tax data, documents, loan contract numbers or detailed asset information. There is no file upload. The form explicitly asks you not to submit confidential financial, account, ID or document data.

Form data is not stored in a database of my own. It is validated on the server and forwarded immediately by email to the business mailbox hamed@finanzierung-speyer.de, where it is processed further.

The purpose is handling your enquiry and, where applicable, taking pre-contractual steps. The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR.

To protect against automated form submissions, an invisible additional field (honeypot), server-side validation of inputs and a limit on the number of requests per sender (rate limiting) are used.

For rate limiting, your IP address is processed only transiently in the server's memory. It is not stored permanently, not included in the contact email and not evaluated for any other purpose.

No external captcha service is used.

The legal basis is Art. 6(1)(f) GDPR (interest in preventing misuse and spam).

Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) is used as a processor pursuant to Art. 28 GDPR for the technical delivery of contact form emails. Brevo processes the contact and message data required for delivery.

Communication with Brevo takes place exclusively server-side via an encrypted HTTPS API. No Brevo script and no Brevo tracker is embedded in the website.

Brevo is used exclusively for transactional contact form emails – not for newsletters, promotional emails, marketing automation, building CRM contact lists from the website form, website tracking or profiling.

Brevo account configuration: transactional log retention of 1 month, no storage of email previews, anonymised email tracking. Opens and clicks are not evaluated on a personal level.

The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (technically reliable transmission of enquiries).

The business mailbox hamed@finanzierung-speyer.de is operated at IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. In this respect IONOS acts as a mail hosting provider and processor pursuant to Art. 28 GDPR; processing takes place on servers in Germany or the EU.

Emails sent via the contact form are received in this mailbox and processed there as part of business communication. The same applies to emails you send me directly.

WhatsApp is integrated solely as an ordinary click-to-chat link (https://wa.me/491749188476).

No WhatsApp or Meta scripts, SDKs or tracking pixels are loaded when the website is opened, so simply visiting the site establishes no connection to WhatsApp or Meta.

A connection is only established once you deliberately click the link. In that case WhatsApp Ireland Limited processes your data under its own terms. If you prefer to avoid this, please use the telephone or email instead.

Architecture: a Google Business Profile managed by myself exists for my business. The reviews published there are retrieved exclusively server-side via the Google Business Profile API. Access uses an OAuth 2.0 flow limited to my own business profile; the credentials (including the refresh token) are stored exclusively server-side and are never transmitted to your browser. The interface is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

No connection when visiting the site: reviews are delivered solely as content already prepared on the server. Visiting this website therefore creates no direct connection from your browser to Google. No Google scripts, no Google Maps, no iframes, no review widgets and no Google analytics services are embedded, and no cookies are set for this purpose. No consent is required for this.

Data displayed: the reviewer's display name, the star rating, the review text and the date of the review. Reviewer profile pictures are deliberately not retrieved or displayed, so that no image files are loaded from Google servers when the page is displayed. No further profile information is used; reviews are reproduced unaltered and unfiltered. All displayed information was previously made public on Google by the reviewers themselves.

Storage period: retrieved review content is cached on the server only temporarily in line with the Google Business Profile API Policy. The cache is refreshed at the latest after 12 hours; content is never stored for longer than 30 calendar days. If a review is deleted or edited on Google, this takes effect in the display with the next retrieval.

Clicking through to Google: if you deliberately click the “Leave a Google review” link, you are forwarded to a Google page. Only from that point does Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) process your data under its own terms, over which I have no influence.

The legal basis for displaying reviews on this website is Art. 6(1)(f) GDPR (interest in transparently presenting genuine customer feedback).

The mortgage financing calculator and the modernisation calculator process all inputs exclusively locally in your browser.

No data is transmitted to a server; there is no database storage, no analytics transmission, no storage in cookies and no disclosure to third parties.

Calculator values are not automatically transferred into the contact form.

Recipients of personal data are the technical service providers named above acting as processors: Lovable (provision and delivery of the website, together with its sub-processors), Sendinblue SAS / Brevo (sending form emails) and IONOS SE (email mailbox).

Beyond that, data is only passed on where necessary to handle your request – for example to banks, Bausparkassen or product providers if you instruct me to obtain offers – or where a legal obligation exists.

Brevo and IONOS process data within the EU. Processing outside the EU/EEA may occur in the context of website hosting via Lovable and its sub-processors; it then takes place on the basis of the safeguards of Art. 44 et seq. GDPR, in particular the EU standard contractual clauses or an adequacy decision in accordance with the current Lovable DPA.

Hosting server and access logs: stored only to the extent and for as long as necessary for operation, security and error analysis, or as specified by the processor. No fixed period is separately documented.

IP address for rate limiting: transient processing in memory; deleted after the short evaluation window or at the latest when the server process restarts.

Brevo transactional logs: retention of 1 month according to the account setting.

Contact enquiries (form, email, telephone notes): deleted once the enquiry has been conclusively dealt with and no statutory retention obligations apply.

If a business relationship arises from an enquiry, commercial and tax retention obligations apply (in particular Sec. 257 HGB, Sec. 147 AO), generally for six or ten years.

The website is delivered exclusively via an encrypted connection (TLS/HTTPS); transmission to Brevo is likewise encrypted via HTTPS.

Form inputs are validated on the server. The number of form fields is deliberately limited and only the data required for processing is collected (data minimisation).

Automated form submissions are limited by honeypot and rate limiting.

Appropriate technical and organisational measures pursuant to Art. 32 GDPR are in place. Absolute protection of data transmitted over the internet cannot be guaranteed.

No solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place via this website.

In particular, no automated credit decision and no binding financing decision is made via the website. The calculators serve solely as non-binding orientation; binding statements are only made during personal advice and by the respective product providers.

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

Where processing is exceptionally based on consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). No consent is currently obtained for the processing described here.

An informal message to the contact details above is sufficient to exercise your rights.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz

Hintere Bleiche 34, 55116 Mainz, Germany

Telephone: +49 6131 8920-0

Email: poststelle@datenschutz.rlp.de

Website: www.datenschutz.rlp.de

This privacy notice reflects the technical state of the website at the time of its last revision. It will be updated as soon as the technical data flows or the services used change.