Privacy Policy
1. An overview of data protection
General
The following information gives a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in our privacy policy below.
Data collection on our website
Who is responsible for the data collection on this website?
Data on this website is processed by the website operator. You will find the operator's contact details in the section "Party responsible for this website" in this privacy policy.
How do we collect your data?
Some data is collected when you provide it to us, for example data you enter in our contact form.
Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data, for example your browser, operating system or the time of your visit. This data is collected automatically as soon as you enter our website.
What do we use your data for?
Part of the data is collected to ensure that the website works without errors. Other data is used to answer your enquiries. We do not analyse your user behaviour.
What rights do you have regarding your data?
You have the right to receive information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have the right to request the correction, restriction of processing or deletion of this data. You can contact us at any time about this or any other questions on data protection. You also have the right to lodge a complaint with the competent supervisory authority.
No analytics, no advertising
We do not use any analytics, tracking or advertising tools on this website. The fonts are hosted on our own server. YouTube videos are only loaded when you click on them. Location maps in the project room are only loaded when you open them. Details can be found in section 4.
2. General information and mandatory information
Data protection
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website, various personal data is collected. This privacy policy explains what data we collect, what we use it for and on what legal basis.
Please note that data transmitted over the internet, for example by email, may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.
Party responsible for this website
The party responsible for processing data on this website is:
Inventus.blue GmbH & Co. KG
Von-Helfenstein-Gasse 429
86899 Landsberg am Lech, Germany
Telephone: +49 8191 9895213
Email: office@inventus.blue
The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data, such as names or email addresses.
Storage period
Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you make a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it, such as retention periods under tax or commercial law.
Withdrawal of your consent to data processing
Some data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. An informal email to us is sufficient. The lawfulness of the data processing carried out until the withdrawal remains unaffected.
Right to object to data collection in special cases (Art. 21 GDPR)
If data is processed on the basis of Art. 6 (1) (e) or (f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. We will then no longer process your data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint with the competent supervisory authority
In the event of a breach of the General Data Protection Regulation, you have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.
Information, correction, restriction and deletion
Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing, and, where applicable, a right to correction, restriction of processing or deletion of this data. You can contact us at any time about this or any other questions on personal data.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as enquiries you send to us, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the address line of your browser beginning with "https://" and by the lock symbol in your browser bar. When encryption is active, the data you transmit to us cannot be read by third parties.
Objection to promotional emails
We hereby object to the use of contact data published in connection with the mandatory imprint for sending advertising and information material that has not been expressly requested. The operators of this website expressly reserve the right to take legal action in the event of unsolicited advertising, for example by spam emails.
3. Data collection on our website
Hosting
This website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany. The servers are located in Germany. When you visit the website, the host processes the data in the server log files (see below) and the content you send via the contact form on our behalf.
The legal basis is Art. 6 (1) (f) GDPR. We have a legitimate interest in providing our website reliably and securely. We have concluded a data processing agreement with the host in accordance with Art. 28 GDPR.
Cookies
For visitors, this website sets a single, technically necessary cookie: a session cookie that assigns your visit to a session. It contains no personal details, is not used for analysis and is deleted as soon as you close your browser. We do not set any analytics or advertising cookies. For sales partners, the sales portal also sets a cookie to identify the device, see "Sales portal: login and record".
It is stored on the basis of Section 25 (2) No. 2 TDDDG and Art. 6 (1) (f) GDPR. We have a legitimate interest in providing our website without technical errors. You can set your browser to reject cookies. The website will remain usable.
Server log files
The host of this website automatically collects and stores information in so-called server log files, which your browser transmits to us automatically. These are:
- Browser type and browser version
- Operating system used
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- IP address
This data is not combined with other data sources. The legal basis is Art. 6 (1) (f) GDPR. We have a legitimate interest in the error-free display and the security of our website, for which the server log files must be recorded.
Contact form
If you send us an enquiry via the contact form, the information you provide in the form, including your contact details, is sent to us by email and stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass this data on without your consent.
The processing is based on Art. 6 (1) (b) GDPR if your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effectively handling the enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time.
The data you enter in the contact form will remain with us until you ask us to delete it, withdraw your consent to its storage or the purpose for storing the data no longer applies, for example after your enquiry has been processed. Mandatory statutory provisions, in particular retention periods, remain unaffected.
Enquiries by email or telephone
If you contact us by email or telephone, your enquiry, including all resulting personal data such as your name and request, will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent. The legal basis and storage period are the same as for the contact form.
Project room
We present selected projects in a protected project room. Access is granted personally. For this purpose we store your name, a short note if required, the projects released to you, the expiry date of the access and the time and number of your logins. We do not store your password in plain text, only as an irreversible check value. After you log in, the session cookie mentioned above keeps you logged in.
When you view or download documents in the project room, we record the time, the project and the document. This allows us to trace who received which version of a document. For accounts of public authorities, and for other accounts on request, we receive one e-mail a day listing the documents you downloaded, and an immediate e-mail when an authority account logs in. We receive no e-mail for merely viewing in the project room. We do not store your IP address. We delete the record in the project room together with your access. We keep a copy as evidence with the documents of the respective project for as long as we keep these documents. If you request a document in the project room or tell us there what is still missing, we store your entry with the time, receive it by e-mail and note it in the record. It is kept in the same way as the record. If you upload a file in the project room, we store it on our server with the time and your access, notify Peter Kerler by e-mail and note it in the record. We use the file only for the procedure concerning your property and keep it with the project documents.
To protect against passwords being guessed, we record failed login attempts. We do not store your IP address, only an irreversible check value derived from it. These entries are deleted after one day.
The legal basis is Art. 6 (1) (b) GDPR insofar as the project room serves to prepare a contract, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest is to make confidential project documents available only to selected persons and to protect access against misuse. We delete your access as soon as it is no longer needed, or earlier at your request.
Sales portal: login and record
For sales partners who work with us, we operate a protected sales portal. There they can see properties, documents and customer data. To prevent misuse of this data, we specially secure the login and record its use. This allows us to detect misuse, block the account immediately and later prove who accessed what and when.
We set up each account personally. For this purpose we store your name, your e-mail address and the status of your account. You log in with a passkey. We store only the public key, an identifier of the passkey, a counter and the name you give the device. The private key never leaves your device. If you wish, you can also set up an authenticator app. We store the shared secret for this in encrypted form. For emergencies you receive 10 backup codes. We do not store these in plain text, only as an irreversible check value. A login is valid for no more than 12 hours, after which you log in again.
To recognise known devices, the sales portal sets its own cookie "vt_geraet". It contains a random number, is valid for 400 days and is only sent to the sales portal. Our database contains only an irreversible check value of it. If your account logs in from an unknown device, we receive a notice.
We record every login, every customer card opened, every page viewed and every download. For each entry we store the time, your IP address, a location estimated from it (city and country) and the type of your browser and device, for example "Safari on iPhone". We also record failed login attempts and changes to your login methods.
We estimate the location with a database held on our own server (DB-IP Lite). We do not pass your IP address to third parties for this purpose. The estimate is imprecise and serves only to detect unusual logins, such as two simultaneous logins at distant locations. IP Geolocation by DB-IP, licensed under Creative Commons Attribution 4.0.
The sales portal checks whether it is being used by a person. It checks the identifier of your browser for known programs and AI agents, counts how quickly pages, customer cards and documents are requested and determines in the browser whether clicks are accompanied by a movement of mouse, finger or keyboard. We do not record the movements themselves. If the portal detects a clear suspicion, the account blocks itself provisionally until we release it after review. Any further decision is always made by a person.
In the event of unusual activity, we receive a message on our mobile phone via the Pushover service (Pushover, LLC, USA) and also an e-mail. The message to Pushover contains only your name and the type of event, no customer data, no location and no IP address. Pushover processes the data in the USA and, according to its own information, bases the transfer on the standard contractual clauses of the EU Commission.
When you download a document, you never receive the original but a version with your name, the date and time and the number of the record entry printed on every page. This allows a document that has been passed on to be traced to its recipient.
Your own picture: sales partners can upload a picture of themselves voluntarily. It appears only to them, at the top right of the sales portal. We store it reduced in size and without the camera data on our server until they remove it or the cooperation ends.
Documents for a reservation: sales partners can upload documents of their customers for a reservation: the self-disclosure, the financing confirmation of the bank and other documents for the purchase, no copies of identity cards. We store them encrypted on our server. If we reject a document, we delete it immediately. If the reservation ends without a purchase, we delete all documents for it. After a purchase we keep them as long as we need them for the processing and for legal obligations. Deleted documents remain encrypted in our backups for up to 14 days.
The legal basis is Art. 6 (1) (b) GDPR insofar as login and record are necessary to carry out our cooperation with you, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest is to protect our customers' data against unauthorised access and misuse, to be able to prove misuse and to settle accounts for the cooperation. We set the cookie "vt_geraet" under Section 25 (2) No. 2 TDDDG because it is strictly necessary for a secure login to the sales portal.
We shorten your IP address after 90 days: for IPv4 the last block is removed, for IPv6 everything after the first 48 bits. We delete failed login attempts after 30 days. We keep the record itself for as long as our cooperation with you continues and for three years thereafter, counted from the end of the year in which the cooperation ends. We then delete it. If we block your account, passkeys, app and backup codes become invalid, but the record is retained.
Lettings (vermietung.inventus.blue)
On vermietung.inventus.blue we present our rental apartments and receive enquiries. The pages set no cookie and load no content from third party servers; the fonts are on our own server.
Enquiry: For an enquiry we need your name, phone number, email address, the apartments or parking spaces you are interested in, from when you would like to rent and, for an apartment, how many people will live there. We use these details to handle your enquiry, arrange a viewing and prepare a tenancy agreement. Optionally you can write us a message; after confirmation it is stored in the history of your enquiry. The legal basis is Art. 6(1)(b) GDPR.
Later offers: If you tick “Please also tell me about apartments and parking spaces that become free later” in the form, we also use your details for this. The legal basis is your consent under Art. 6(1)(a) GDPR. It takes effect only with your confirmation by email. You can withdraw it at any time with the link in the confirmation email or by email to vermietung@inventus.blue; your current enquiry remains.
Confirmation by email: After sending we email you a link. Only when you confirm your enquiry with it does it reach us. If you do not confirm within 7 days, we delete the enquiry together with the email to you.
Protection against misuse: To prevent mass enquiries in other people's names, we store a key calculated from your IP address with an unconfirmed enquiry; we do not store the IP address itself. The key is removed on confirmation, otherwise after 7 days together with the enquiry. We do not store enquiries from automated programs. The legal basis is Art. 6(1)(f) GDPR, our interest is a form free of misuse.
After confirmation: We store your details with a history: when you enquired and confirmed, emails between you and vermietung@inventus.blue with their text, viewing appointments, acceptance or rejection and our notes on the enquiry. Only our administration can see this after logging in.
Deletion: We delete your details, the history and the emails 6 months after the last entry in the history. If you ticked the box for later offers, we delete them 3 years after the last entry. A withdrawal is itself an entry; from then on 6 months apply again. Emails to vermietung@inventus.blue that belong to no enquiry are deleted after the same period. We also delete copies of our emails in our mailboxes after these periods.
Withdrawal: Every confirmation email and the confirmation page contain a link to withdraw your enquiry or, if you ticked the box, only the consent for later offers. If you withdraw the enquiry, we delete your details, the history and our emails with you at once. An email to vermietung@inventus.blue or office@inventus.blue works as well.
Emails: We send and receive our emails through our host mittwald, with whom we have a data processing agreement.
4. Videos, maps, fonts and links
YouTube with two-click solution
On some pages we show videos from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We embed the videos with a two-click solution. When you open the page, you first only see a preview image stored on our own server. No connection to YouTube is established. Only when you click on the preview image does your browser load the video from YouTube's servers. For this we use YouTube's privacy-enhanced mode (youtube-nocookie.com).
When you click, data is transferred to YouTube, in particular your IP address and the information which of our pages you have visited. If you are logged in to YouTube or Google, YouTube can assign the request to your account. YouTube may also store or read information on your device. Data may be transferred to Google servers in the USA. Google is certified under the EU-US Data Privacy Framework.
The legal basis is your consent, which you give by clicking on the preview image (Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG). Without a click, no data is transferred to YouTube. Further information can be found in Google's privacy policy: policies.google.com/privacy.
Location maps in the project room
For some projects in the project room we show a location map. It is only loaded when you open the "Location" section. Your browser then loads map tiles from the Federal Agency for Cartography and Geodesy in Frankfurt am Main (basemap.de) and, if you select the aerial view, from the Bavarian Surveying Administration in Munich. If the map of the Federal Agency is not available, your browser loads the map tiles from OpenStreetMap instead (OpenStreetMap Foundation, United Kingdom).
The respective provider receives your IP address and technical information about your browser. The EU Commission has recognised an adequate level of data protection for the United Kingdom. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is a clear presentation of the location. As long as you do not open the section, no data is transferred to the map providers.
Fonts
The fonts of this website are hosted on our own server. When you open our pages, no connection is established to Google or any other font provider.
Links to LinkedIn and X
At the top of every page we link to our profiles on LinkedIn and X. These are simple links, not embedded functions of these networks. No data is transferred to LinkedIn or X when you visit our pages. Only when you click on one of these links do you leave our website, and the privacy policy of the respective network applies.
Last updated: October 2026