Data protection

Looking for certain features
Advanced search

Data protection

Privacy policy

1. Data protection at a glance

General information

This statement tells you what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified.

We have set up this website so that fonts, icons and program libraries are loaded from our own server. As at the date of this statement, simply opening a page does not create any connection to third-party servers. Two services only load once you activate them: the map on the property and contact pages, and the spam protection on our forms. Both are described under point 6.

Who is responsible?

The controller is the operator of this website. You will find the details under point 2 and in the legal notice.

How do we collect your data?

On the one hand, because you provide us with data, for example in an enquiry form. On the other hand, our server automatically records technical data when the website is opened, such as browser type, operating system and the time of access.

What do we use your data for?

To provide the website free of errors, to answer your enquiries and to measure how our offering is used.

What rights do you have?

You have the right to access, rectification, erasure, restriction of processing, data portability, withdrawal of consent you have given, and to lodge a complaint with a supervisory authority. Details are set out under point 3.

2. Controller and scope

Controller

Hoffrohne Nekretnine d.o.o. (GmbH) – MAASS Croatia
Philip Maass
Privlacka Ulica 6
HR – 23000 Zadar
Croatia

Telephone: +385 – (0) 23 / 325 310
E-mail: info@maasscroatia.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Scope

Our offering is available in ten languages, each under its own internet address. All language versions are delivered from the same installation on the same server and process your data in the same way. This statement applies to all ten:

  • German: www.kroatien-immo.de
  • English: www.croatiarealestate.co.uk
  • Czech: www.chorvatsko-nemovitost.com
  • Danish: www.ejendomme-kroatien.com
  • Croatian: www.hrvatske-nekretnine.com
  • Hungarian: www.ingatlanok-horvat.com
  • Italian: www.immobiliare-croazia.com
  • Dutch: www.maasscroatia.nl
  • Polish: www.chorwackie-domy.com
  • Russian: www.horvatii-nedvizhimost.com

3. Your rights and general information

Legal bases

We only process your data where the law permits us to do so. We rely on the following bases:

  • Your consent, Art. 6(1)(a) GDPR. You give it, for example, when you tick the box in an enquiry form.
  • Steps prior to entering into a contract, or the performance of a contract, Art. 6(1)(b) GDPR. This concerns above all your enquiries about individual properties.
  • Our legitimate interest, Art. 6(1)(f) GDPR, in an offering that is secure, free of errors and clearly structured.

The storing of information on your terminal equipment and access to it are additionally subject to the special rules on the protection of privacy in terminal equipment. Under those rules consent is required unless the access serves to carry out the transmission of a communication or to provide a service that you have expressly requested. Which basis applies in an individual case is stated with the respective processing under points 4 to 6.

Storage period

Where a specific period is stated below, that period applies and deletion runs automatically. Where no period is stated, we store your data until the purpose of the processing ceases to apply. Statutory retention obligations, for example under tax and commercial law, remain unaffected.

Your rights in detail

You have the following rights vis-à-vis us:

  • Access (Art. 15 GDPR): At any time you can find out free of charge what data we have stored about you, where it comes from, to whom we pass it on and what we use it for.
  • Rectification (Art. 16 GDPR): We must correct inaccurate data and complete incomplete data.
  • Erasure (Art. 17 GDPR): You can request the erasure of your data insofar as we no longer need it and no retention obligation stands in the way.
  • Restriction of processing (Art. 18 GDPR): Instead of erasure you can request that we only store your data and otherwise no longer use it. This applies while we verify the accuracy of your data, where the processing was unlawful, where you still need the data for legal claims, or as long as no decision has been taken on an objection under Art. 21 GDPR.
  • Data portability (Art. 20 GDPR): Data that we process by automated means on the basis of your consent or of a contract will be handed over to you or to a third party in a commonly used, machine-readable format, insofar as this is technically feasible.
  • Withdrawal (Art. 7(3) GDPR): You can withdraw consent you have given at any time with effect for the future. Processing carried out up to the withdrawal remains lawful.
  • Complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence, your place of work or the place of the alleged infringement.

A message to the address given above is sufficient for all of this.

Right to object under Art. 21 GDPR

IF THE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE LEGAL BASIS ON WHICH A PROCESSING OPERATION IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSES OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSES OF DIRECT MARKETING (OBJECTION UNDER ART. 21(2) GDPR).

Encrypted transmission

This website uses SSL or TLS encryption throughout. You can recognise it by the fact that your browser’s address bar begins with “https://” and shows a padlock symbol. What you send us via the forms cannot be read by third parties along the way.

The further route of a message is not secured by this. Transmission by e-mail can have security gaps; complete protection against access by third parties is not possible there.

Transfers to third countries

Two of the services described under point 6 process data outside the European Union, and both only after you have activated a map or a form.

For the spam protection, a transfer to Google in the USA may take place. On 10 July 2023 the European Commission adopted an adequacy decision for the USA on the EU-US Data Privacy Framework. Google LLC is certified under this framework. The decision is currently under review before the Court of Justice of the European Union and remains in force until a decision is taken.

For the map, a transfer takes place to the OpenStreetMap Foundation in the United Kingdom. For the United Kingdom the European Commission adopted an adequacy decision on 19 December 2025 which applies until 27 December 2031.

4. Hosting and data backup

External hosting

This website runs on a rented server of an external service provider. All data arising on this website is held on that server. This is above all IP addresses, contact enquiries, access and communication data, and all other data generated via a website.

We use the service provider in order to make our offering available securely, quickly and reliably. The legal basis is Art. 6(1)(f) GDPR and, insofar as steps prior to entering into a contract are concerned, Art. 6(1)(b) GDPR. Our service provider processes your data only to the extent necessary for its service, and does so in accordance with our instructions.

We use the following provider:

STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin

We have concluded a data processing agreement with our host pursuant to Art. 28 GDPR.

Data backup

We back up the website regularly so that it can be restored after a failure. The backups are held on the same server and are not transferred to third parties. The database is backed up every eight hours, thirty backups are kept, which corresponds to about ten days.

As long as a backup is kept, it also contains data that has already been deleted in live operation. It disappears together with the backup. The legal basis is our legitimate interest in an operationally secure offering, Art. 6(1)(f) GDPR.

5. Data collection on this website

Server log files

Our server automatically records and stores information that your browser transmits with every access:

  • browser type and browser version
  • operating system used
  • previously visited page (referrer)
  • address requested and volume of data transferred
  • time of the server request
  • IP address

We do not merge this data with other data sources. It is needed in order to deliver the website, to detect faults and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. The logs are deleted automatically after about ten days.

Cookies and access to your terminal equipment

Cookies are small text files that are placed on your terminal equipment. They do no damage there. Session cookies are deleted automatically after your visit; persistent cookies remain until you or your browser delete them.

The following cookies are set on this website:

  • PHPSESSID – a technical session identifier of our web server. It is how the website remembers, during your visit, for example the order in which properties are shown to you on the home page. It contains no information about you and is deleted as soon as you close the browser.
  • wp-wpml_current_language – remembers which language version you are using, so that the pages are delivered in that language. Lifetime one day.
  • borlabs-cookie – stores your decision in the cookie notice so that we do not have to ask you again on every visit. Lifetime 365 days.
  • _GRECAPTCHA – is set by Google as soon as the spam protection loads, that is only when you fill in a form. Further details under point 6.

The first three cookies are necessary for the website, the language selection and the cookie notice to work. No consent is required for them; they contain no information by which you could be identified. You can set your browser to inform you about cookies, to allow them only in individual cases or to refuse them generally. The website may then be usable only to a limited extent.

Consent management

We use Borlabs Cookie in order to obtain, store and be able to demonstrate your decision about cookies. The software runs on our own server; no data is transferred to third parties in the process.

What is stored is a randomly generated identifier, the version number of the notice, your selection and the point in time. Your name and your IP address are not stored. The log is deleted after 365 days.

The purpose is to fulfil our obligation to demonstrate consent under Art. 7(1) GDPR. The legal basis is Art. 6(1)(c) GDPR. You can change your selection at any time via the cookie notice.

Audience measurement

We measure how often our pages are opened in order to improve our offering. For this we use WP Statistics. The software runs entirely on our own server. No data is transferred to third parties and no external analytics service is integrated.

The measurement is deliberately set up sparingly:

  • Your IP address is truncated and additionally converted into a value that cannot be reversed. The full IP address is not stored.
  • Your browser identifier is not stored.
  • No cookie is set and your terminal equipment is not accessed.
  • Only the approximate place of origin is derived from the truncated IP address.
  • If your browser sends the “Do Not Track” setting, you are not counted.

The measurement data is deleted automatically after 180 days. Beyond that, only plain counter values without any link to individual visits are retained. The legal basis is our legitimate interest in designing our offering in line with demand, Art. 6(1)(f) GDPR. No consent is required for this, because no cookie is set, your terminal equipment is not accessed and no third party is involved.

Enquiries via our forms

There is an enquiry form on every property page, and in addition there is a general contact form. In the enquiry form for a property we ask for your name, e-mail address, telephone number, address, postcode, town and your message. In the general contact form, address, postcode and town are omitted.

Before you can send, you expressly confirm that we may store your details in order to answer your enquiry. You can withdraw this consent at any time with effect for the future; an informal message to us is sufficient.

The legal basis is your consent, Art. 6(1)(a) GDPR, as well as Art. 6(1)(b) GDPR insofar as your enquiry serves to take steps prior to entering into a contract.

What happens to your enquiry:

  • It is sent to our business e-mail address and processed there. Dispatch runs via our host’s mail server.
  • In addition, the message with all details is logged in the database of this website. This log serves to detect delivery problems and is deleted automatically after 90 days.
  • In our mailbox your enquiry remains until the purpose ceases to apply, for example once processing is completed, or until you ask us to delete it. Statutory retention periods remain unaffected.

Your enquiry is processed exclusively by e-mail. We do not transfer it into an estate agency system or a customer file, and we do not pass your details on to third parties without your consent.

Enquiry by e-mail, telephone or fax

If you contact us in this way, we store your enquiry including all personal data contained in it in order to deal with your request. We do not pass this data on without your consent.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry serves to take steps prior to entering into a contract or to perform a contract, otherwise our legitimate interest in dealing with incoming enquiries, Art. 6(1)(f) GDPR, or your consent, Art. 6(1)(a) GDPR.

Your enquiry remains with us until you ask us to delete it, withdraw your consent or the purpose ceases to apply. Statutory retention periods remain unaffected.

6. Integrated services and content

Map (OpenStreetMap)

On property pages and on the contact page we show the location on a map. The map does not load by itself. You first see an area with a notice and the button “Load map”. Only when you click on it is the map material retrieved.

The provider of the maps is the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. When the map is retrieved, your IP address and the map section requested are transmitted to the OpenStreetMap Foundation. Without this transmission the map cannot be displayed.

The legal basis is your consent, Art. 6(1)(a) GDPR. You give it by clicking the button, and the notice beside it tells you beforehand what happens in the process. If you do not click, no transmission takes place. The release applies only to the map you have opened; it is not stored, and we do not set a cookie for it.

You can find the privacy policy of the OpenStreetMap Foundation at https://wiki.osmfoundation.org/wiki/Privacy_Policy.

Spam protection (Google reCAPTCHA)

Our forms are protected against automated entries. For this we use reCAPTCHA from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The protection does not load when the page is opened, but only when you touch a form, that is when you start entering data. If you do not fill in a form, no connection to Google is created.

As soon as the protection loads, it checks on the basis of various characteristics whether the entry comes from a human being. Among the things evaluated are your IP address, the time spent on the page and your mouse and keyboard movements on the page. This data is transmitted to Google; a transfer to the USA may take place in the process, see point 3. Google sets its own cookie in this context.

The legal basis is our legitimate interest in protecting our forms against abusive automated use and against spam, Art. 6(1)(f) GDPR. The access to your terminal equipment serves the function that you have expressly requested: without the check, our website does not technically accept the form, so your message could not be sent at all. If you do not fill in a form, neither access nor transmission takes place.

Further details can be found in Google’s privacy policy at https://policies.google.com/privacy?hl=en and in the terms of service at https://policies.google.com/terms?hl=en.

Content from our own server

Fonts, icons, program libraries and images of this website are held on our own server. Beyond the two services mentioned above, no content is retrieved from third-party servers when a page is opened.

This statement describes the position as at the date of this privacy policy. If we change anything about it, we will change this section first.

Last updated

This privacy policy is dated 14 August 2026.