Privacy Information pursuant to Art. 13 GDPR
Below, we inform you about the extent to which personal data is collected when accessing our website and the purposes for which it is processed.
2. Name and Contact Details
You can reach the controller pursuant to Art. 4 (7) GDPR for this website at the following address:
Quantum Immobilien AG
Dornbusch 4
D-20095 Hamburg
Phone: +49 (0) 40 / 41 43 30 – 0
Email: Info(at)quantum.ag
Further information can be found in the legal notice.
You can reach our company data protection officer at:
Quantum Immobilien AG
Keyword: Data Protection Officer
Dornbusch 4
D-20095 Hamburg
Phone: +49 (0) 40 / 41 43 30 – 0
Email: Datenschutz(at)quantum.ag
3. General Overview
On our website, we offer various services and use data processing operations listed below:
— Operation of the website
— Cookies
— Use of Google Analytics 4, Google Ads, and Google Tag Manager
— Email newsletter subscription
— Contact forms for website visitors, press representatives, and prize draws
— Facebook / Instagram fan page
— TikTok fan page
Your data is processed internally exclusively by authorized employees. We do not disclose your personal data to third parties unless you have consented to such disclosure, or we are entitled or obliged to do so on the basis of legal provisions and/or official or court orders. We use external service providers (processors) to provide these services. These include IT service providers and marketing agencies.
We have carefully selected our service providers and contractually bind them in accordance with legal requirements, for example as processors pursuant to Art. 28 GDPR. Where these providers process your data outside the European Union or the European Economic Area, we ensure that either an adequacy decision exists or that they are bound by EU Standard Contractual Clauses.
The provision of your personal data is neither legally nor contractually required for the mere visit to our website. However, it is partly necessary in order to use certain functions or services, for example contact forms, newsletter registration, rental inquiries, or participation in prize draws. In such cases, we cannot process your request or initiate or perform the desired contract without the data marked as mandatory. Where we process data on the basis of your consent (e.g. for analysis and marketing cookies), the provision of such data is voluntary. If you do not provide your data, the corresponding functions (e.g. personalized advertising, statistical evaluations) may not be available or may only be available to a limited extent.
3.1 Operation of the Website
When you access the website, your device automatically transmits personal data to our server, where it is stored temporarily in a log file. This includes, among other things:
— Name and URL of the retrieved file
— Date and time of access
— Volume of data transferred
— Message indicating successful retrieval
— Browser type and version
— Operating system
— Previously visited website
— Websites accessed by your system via our website
— User’s internet service provider
— IP address of the device
Your data is processed for the following purposes based on our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR:
— Enabling the use of our website,
— Presenting our portfolio of services,
— Ensuring the proper operation of our website, as well as
— Fulfilling legal obligations, such as
• defending against and investigating cyberattacks, and
• legally compliant documentation and verifiability of consent and the control of marketing measures, videos, and maps.
In our consent tool “Cookies,” the following data is processed on the basis of your consent pursuant to Art. 6 (1) sentence 1 lit. a and Art. 7 GDPR:
— Cookie duration and version
— Logbook data (Consent ID, Processor ID, Controller ID, consent status, date and time)
— Consent data
— Data on the devices used, such as shortened IP addresses (IP v4, IP v6), device information, date and time
Personal data is automatically deleted after the end of the connection unless statutory retention obligations or our legitimate interests or those of third parties prevent deletion. Your consent for the respective services is stored on your device for 12 months, provided you have allowed this, so that you do not have to make a new selection on your next visit.
The collection of data for the provision of our website and the storage of data in log files is absolutely necessary for the operation of the website. Therefore, you have no option to request deletion, object, or demand correction in this respect.
You can change your consent at any time by clicking the following link:
Change cookie settings
3.2 Cookies
Our website uses cookies in order to provide you with a convenient and feature-rich online service and to verify your authorization to use our services. In addition, it stores whether you have consented to certain processing activities.
A cookie is information stored on your device (computer, smartphone, tablet, etc.), depending on the browser used, for example in the form of a text file or in a database. This information can be read again by our web server or by service providers used by us when you navigate on our website or revisit it.
The website’s cookies may contain personal data. Cookies save you from entering data multiple times, facilitate the transmission of specific content, and help us identify particularly popular areas of our website. They thus enable us to continuously improve the structure and content of our website.
To manage your consent to the setting of cookies and similar technologies, we use the service “Cookie Consent Manager CCM19.” The provider is Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany. This service is used to store which categories of cookies you have allowed or rejected and which individual services may be activated.
For this purpose, among other things, the entry “ccm_consent” is stored in your browser’s local storage for up to 1 year, documenting your chosen cookie settings. Further information can be found in the provider’s privacy policy at https://www.ccm19.de/datenschutzerklaerung.html
The legal basis for storing necessary cookies on your device is § 25 (2) sentence 2 of the German Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG). The storage of necessary cookies is required in particular for:
— logging and storing your consent settings in the consent banner (e.g. via Cookie Consent Manager CCM19), as well as
— the technically necessary provision of basic functions of our website, such as multilingualism via the WPML plugin.
Without these technically necessary cookies, consent management and certain basic website functions cannot be provided.
If cookies are used for other purposes (i.e. not technically necessary), such as web analysis and reach measurement as well as measuring the success of advertising measures, processing takes place on the basis of your consent pursuant to Art. 6 (1) sentence 1 lit. a in conjunction with Art. 7 GDPR. The legal basis for storing non-essential cookies on your device is § 25 (1) TDDDG. Services requiring consent include in particular:
— Google Analytics 4 (web analysis, reach measurement, usage statistics)
— Google Ads (conversion tracking, possibly interest-based advertising / remarketing)
Cookies are stored on your computer and transmitted from it to our site. Therefore, as the user, you also have full control over the use of cookies. By changing your browser settings, you can deactivate or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This also allows you to revoke your consent with effect for the future at any time. This can also be done automatically on your device. Use your browser settings to adapt cookie rules to your needs. If cookies are deactivated for our website, not all website functions may be fully available, and you may have to make your privacy settings again on your next visit.
In the consent banner, under “Settings,” you can view details about the cookies set, the services used, and their storage duration. You can object to your consent at any time without affecting the lawfulness of data processing carried out until the revocation. To do so, click the corresponding button/link (“Cookie Settings”) to adjust your settings and view the storage duration of cookies under “Providers.”
3.3 Use of Google Analytics 4, Google Ads, and Google Tag Manager
We use the web analytics service Google Analytics 4 and Google Ads (conversion tracking, possibly remarketing) on this website, which are integrated via Google Tag Manager. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics 4 enables us to analyze user behavior on our website, measure reach, and continuously optimize our content. We use Google Ads to measure the effectiveness of our advertising measures (e.g. whether users perform certain actions after clicking on an ad) and, where applicable, to display interest-based advertising. Google Tag Manager serves solely to centrally manage and trigger these tags; to our knowledge, the tool itself does not process any content or user data, but merely forwards requests to the services integrated in each case.
In connection with the use of Google Analytics 4 and Google Ads, the following categories of personal data may in particular be processed:
— Browser and device information (e.g. browser type, operating system, language settings, screen resolution)
— IP address of the device (according to Google, in GA4 generally used only to derive location data and then shortened or not permanently stored)
— Date and time of access
— Pages visited, click paths, and interactions (e.g. dwell time, scrolling behavior, downloads, form completions)
— Referrer URL (which website or advertisement brought you to our website)
— Approximate location information (region)
— Possibly technical identifiers and online identifiers (e.g. cookie IDs, advertising IDs, user ID, if implemented)
Google Ads conversion tracking also processes information on whether a defined action (conversion), such as a purchase or contact inquiry, occurred after a click on one of our advertisements.
Your data is processed for the following purposes:
— Evaluating the use of our website (reach measurement, usage statistics)
— Improving the functionality, content, and user-friendliness of our website
— Measuring the effectiveness of online advertising measures (conversion tracking)
— Possibly displaying interest-based advertising (remarketing, audience-specific ad targeting)
The legal basis for the use of Google Analytics 4, Google Ads, and Google Tag Manager is your consent pursuant to Art. 6 (1) sentence 1 lit. a and Art. 7 GDPR in conjunction with § 25 (1) TDDDG, which you grant via our consent banner. You can revoke or adjust your consent at any time with effect for the future via the cookie/privacy settings on this website.
For Google Analytics 4 and Google Ads, cookies and similar technologies are used to recognize returning users, assign sessions, and record interactions. In particular, the following identifiers may be used for this purpose (examples; depending on configuration and the functions used): _ga, ga, _gid, gac, gcl*. The exact storage duration of cookies may vary depending on the cookie type and browser settings.
We have limited the retention period for event and user data in Google Analytics 4 to 14 months. After that, the data is automatically deleted.
As a rule, no transfer to countries outside the EU or the EEA (so-called third countries) takes place. However, it cannot be ruled out that personal data may be transferred in the course of using the services to affiliated companies of the Google Group in third countries (in particular to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The transfer takes place on the basis of the adequacy decision of the EU Commission regarding the EU-U.S. Data Privacy Framework (TADPF).
The consent decisions you make in the consent banner (e.g. for “Analysis” and “Marketing”) are transmitted to Google and determine whether and to what extent Google Analytics 4 and Google Ads may set cookies and process personal data for analysis and advertising purposes. If you do not grant consent, the corresponding tags will either not be executed at all or only in a limited, non-personalized form.
You can revoke or adjust your consent at any time with effect for the future via the cookie settings on our website. In addition, you can prevent the storage of cookies by adjusting your browser software accordingly or delete cookies that have already been set; however, please note that in this case not all website functions may be fully available.
Further information on data processing by Google and on settings and objection options can be found in Google’s privacy policy at https://policies.google.com/privacy and in the Google Analytics Help.
If you are already logged in to Google with your Google account, Google Analytics assigns this information to your personal user account. Log out of your Google account if you do not want the data to be assigned to your Google profile.
3.4 Contact Forms for Website Visitors, Press Representatives, and Prize Draws
We provide various contact forms on our website (e.g. for rental inquiries, general contact with the center, press inquiries, or participation in prize draws). Depending on the type of form, the following data in particular may be processed via these forms:
— Personal master data (e.g. name)
— Contact data (e.g. address, email address, telephone number)
— Where applicable, company-related data (e.g. company, function)
— Communication content (your message or inquiry), as well as
— In the case of prize draws, additional information required to conduct the prize draw (e.g. preferred prize, age confirmation)
The processing of your personal data via the contact forms is carried out—depending on the type of form—for the following purposes and on the following legal bases:
— For rental inquiries, inquiries regarding leasing or contract conclusions, and comparable inquiries: for the initiation, performance, or termination of a contractual relationship pursuant to Art. 6 (1) sentence 1 lit. b GDPR.
— For general inquiries (e.g. questions about the center, events, service inquiries) as well as press inquiries: on the basis of our legitimate interest in responding to incoming inquiries and maintaining communication pursuant to Art. 6 (1) sentence 1 lit. f GDPR; in this context, it corresponds to the reasonable expectations of the inquiring persons that we use their information to process the inquiry.
— For conducting the prize draw (e.g. recording participation, drawing winners, and notifying winners) pursuant to Art. 6 (1) sentence 1 lit. b GDPR; where data is additionally used for advertising or information purposes in the context of the prize draw, this is done only on the basis of separate consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR, which is voluntary and may be revoked at any time. Further information can be found in the respective terms and conditions of participation for the prize draw.
The data transmitted by you will be processed exclusively by us and, where applicable, by processors and third parties engaged by us (e.g. center management or tenants), strictly for the intended purpose.
As a rule, no transfer to countries outside the EU or the EEA (so-called third countries) takes place in connection with the contact forms. However, it cannot be ruled out that due to the contact, data may be transmitted to servers of Microsoft Corporation in the USA as part of the Microsoft services we use.
The European Commission has determined, with the EU-U.S. Data Privacy Framework (adequacy decision), that an adequate level of data protection exists for transfers to certain certified companies in the USA. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework and is obliged to comply with the data protection obligations laid down therein. On this basis, a transfer of personal data to the USA is permissible.
Your data will only be stored for as long as necessary to process the respective inquiry or carry out the respective process (e.g. conclusion or rejection of a rental inquiry, completion of press contact, full handling of the prize draw), provided no statutory retention obligations prevent deletion.
Where processing is based on your consent, you may revoke it at any time with effect for the future; moreover, you may object to processing based on Art. 6 (1) sentence 1 lit. f GDPR on grounds relating to your particular situation.
3.5 Email Newsletter Subscription
Our website enables you to receive a free email newsletter on a regular basis, through which we regularly inform you about our services and news from our industry.
To subscribe to our email newsletter, we require your email address. We use the double opt-in procedure for registration. This means that we will only send you email newsletters once you have confirmed, via a link contained in an email sent by us after your registration, that you wish to subscribe. Your registration and confirmation are logged. In doing so, the IP address of your device, your email address, and the time of confirmation are stored. This is intended to ensure that you yourself, as the user of the specified email address, have registered for our email newsletter service.
If you open the email or click links in the email—and unless you have technically prevented this yourself—your IP address, the time, and your action are stored by us and statistically evaluated for the purpose of continuous optimization. The processing of your email address after your confirmation serves to send you the email newsletter in a target-group-oriented manner. The email address is used exclusively for sending the email newsletter. The legal basis for the processing of data after your registration for the email newsletter is your consent pursuant to Art. 6 (1) sentence 1 lit. a in conjunction with Art. 7 GDPR.
The logging of your registration before confirmation, the processing of the IP address and the time of registration, as well as the analysis of your reading behavior serve our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in enabling and documenting your registration and, if necessary, clarifying any possible misuse of your personal data.
For the dispatch and evaluation of our email newsletter, we use the service provider Positive Group Deutschland GmbH (brand “rapidmail”), Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany, as a processor. A data processing agreement pursuant to Art. 28 GDPR has been concluded with rapidmail. If you register for our email newsletter, the data provided during registration will be transmitted to rapidmail and processed there exclusively for dispatch and evaluation purposes. No transfer to third countries takes place.
Your personal data will be deleted in accordance with your revocation or if the service is discontinued. If you revoke your consent, you will no longer receive email newsletters. Your data will be deleted from all IT systems unless another legal basis exists for processing your email address. If you do not confirm your newsletter registration, your data will be automatically deleted within 4 weeks.
You can unsubscribe from receiving future email newsletters at any time. This can be done via a special link at the end of the email newsletter or by sending a corresponding message by email to the address indicated in the newsletter.
3.6 Facebook / Instagram Fan Page
On our Facebook / Instagram fan page, we provide you with further information. Please note that you use the fan page and its functions at your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating).
When visiting the fan page, the provider records, among other things, your IP address and further information in accordance with section 3.1, which is stored in the form of cookies on your PC. The information is used to provide us with statistical information about the use of our fan page, to analyze website visitors, and to tailor our offering to target groups.
For this purpose, we use preconfigured reports such as the total number of page views, “likes,” devices used, page activities, post interactions and reach, user activities (comments, shared content, replies), origin (country and city), language, shop views and clicks, age group, gender, educational level, occupation, relationship status, clicks on telephone numbers, or fan page groups linked to our page. For example, we use age and gender distribution for targeted communication and users’ preferred visiting times for time-optimized planning of our posts.
We can limit the analysis temporally and in terms of content, but we have no influence on the display, processing, and presentation of the insights. As the provider of the information service, we do not process any further data from your use of our service beyond this.
In accordance with the provider’s terms of use, which every user accepted when creating a social media profile, we can identify the subscribers and fans of our fan page and view their profiles and other information they have shared.
The way in which the provider uses the data from your visit to our fan page for its own purposes, such as analyzing your personal data and creating personalized advertising, user profiles, and market research, the extent to which activities on the fan page are assigned to individual users, how long the data is stored, and whether data from a visit to the fan page is passed on to third parties, is not conclusively and clearly specified by the provider and is unknown to us.
The provider also processes information about its users’ devices (e.g. as part of the “login notification” function); it may therefore be possible for the provider to assign IP addresses to individual users. The provider uses cookies for the further processing of this information, i.e. information stored on users’ various devices. If you have a profile and are logged in, storage and analysis also take place across devices.
For the information service offered, we operate joint controllership with the provider pursuant to Art. 26 GDPR. The legal basis for the processing of personal data is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest is to draw attention to our services and to be able to communicate with you.
Data processing is carried out with Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland. It cannot be ruled out that your data may be transferred to a third country to Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA within the framework of an adequacy decision (https://www.dataprivacyframework.gov).
If you are logged in as a Facebook / Instagram user, a cookie containing your user ID is usually stored on your device. This enables the provider to track that you have visited this page and how you used it. This also applies to all other fan pages.
Through pixels integrated into websites, the provider is able to record your visits to these websites and assign them to your profile. Based on this data, content or advertising can be offered to you in a tailored way. If you wish to avoid this, you should log out of the provider, deactivate the “stay logged in” function, delete the cookies present on your device, and close and restart your browser. In this way, information through which you can be directly identified is deleted. You can then use our fan page without revealing your user ID. If you access interactive functions of the page (like, comment, share, messages, etc.), a fan page login screen appears. After any login, you are once again recognizable to the provider as a specific user.
Since only the provider has full access to user data, we recommend that you contact the provider directly if you have requests for information or other questions regarding your rights as a user (e.g. right to deletion). Alternatively, we offer support at the above address in asserting your rights. You may also exercise your rights to object directly with the provider.
Further information on data protection can be found in the provider’s privacy policies for Facebook and Instagram. There you will also find information on contact options with the provider and on settings for advertisements.
3.7 TikTok Fan Page
We operate a fan page on TikTok in order to provide information there about our center and our offers and to communicate with you. The service provider in the EEA is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
When you visit our TikTok presence, TikTok processes users’ personal data as an independent controller, e.g. IP address, device and usage data, interaction data (likes, comments, views), as well as information from cookies and similar technologies. We have no influence on the nature and scope of this processing and receive from TikTok only aggregated usage statistics (“TikTok Analytics”) that cannot be traced back by us to individual persons.
Where we ourselves process personal data, this is done exclusively in connection with your direct interaction with our TikTok presence: when you like, comment on, share, mention, follow our channel, or send us direct messages. In this case, we process in particular your TikTok username, profile picture, the content of your posts/messages, and the associated metadata (e.g. time of interaction) in order to answer your inquiries, moderate posts, and align our public relations work. The legal basis is our legitimate interest in maintaining a modern external presentation and communication pursuant to Art. 6 (1) lit. f GDPR. Where your inquiry is aimed at concluding or performing a contract (e.g. rental inquiry), we additionally base the processing on Art. 6 (1) lit. b GDPR.
For the creation of the above-mentioned usage statistics (“TikTok Analytics”), TikTok and we are joint controllers within the meaning of Art. 26 GDPR. TikTok collects and processes the detailed usage data, while we only receive summarized evaluations in order to assess the reach and target group structure of our presence and to design content according to interests. The legal basis is our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR. TikTok makes the relevant agreement (“TikTok Analytics Joint Controller Addendum”) available at https://www.tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en
According to TikTok, personal data of users from the EEA may—besides processing within the EEA—also be transferred to third countries (including the United States and the People’s Republic of China). On 30 April 2025, the Irish Data Protection Commission (DPC) decided that earlier transfers of EEA user data to China by TikTok had violated the GDPR because an essentially equivalent level of protection had not been demonstrated, and required TikTok to adapt its processing. TikTok appealed this decision to the High Court of Ireland; the High Court provisionally suspended enforcement of the decision, so that transfers may continue until a final decision on the appeal is reached. In connection with EEA data, TikTok refers to its “Project Clover” program, under which, among other things, European data centers, a European data unit, and additional security and access controls are to be introduced.
The use of our TikTok presence is voluntary and not necessary in order to obtain information about our center or to contact us.
If you wish to avoid TikTok processing your personal data, you may alternatively use our information services at any time via our website at www.hofstatt.info and contact us through the contact options provided there (e.g. contact form, email, telephone).
Further information on data processing by TikTok, on legal bases, storage periods, privacy settings, and your data subject rights vis-à-vis TikTok can be found in TikTok’s privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/de and in the linked help pages there.
4. Your Rights as a Data Subject
Where your personal data is processed on our website, you as a data subject within the meaning of the GDPR are entitled to the following rights:
— Art. 15 GDPR: Right of access by the data subject
You have the right to obtain from us information about which data concerning you we process.
— Art. 16 GDPR: Right to rectification
If the data concerning you is inaccurate or incomplete, you may request the rectification of inaccurate data or the completion of incomplete data.
— Art. 17 GDPR: Right to erasure
Under the conditions of Art. 17 GDPR, you may request the erasure of your personal data. Your right to erasure depends, among other things, on whether the data concerning you is still required by us for the fulfillment of our legal obligations.
— Art. 18 GDPR: Right to restriction of processing
Under the conditions of Art. 18 GDPR, you may request the restriction of the processing of your personal data.
— Art. 21 GDPR: Right to object
For reasons arising from your particular situation, you may object at any time to the processing of data concerning you.
— Art. 7 (3) GDPR: Right to withdraw consent
You have the right to withdraw consent given for the processing of your personal data at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent until withdrawal.
— Art. 77 GDPR: Right to lodge a complaint with a supervisory authority
If you consider that the processing of personal data concerning you is unlawful, you may lodge a complaint with a data protection supervisory authority competent for your place of residence or work or for the place of the alleged infringement. The supervisory authority responsible for us is:
The Hamburg Commissioner for Data Protection and Freedom of Information (www.datenschutz-hamburg.de).
5. Status and Updates
We reserve the right to update this information from time to time in order to improve data protection and/or adapt it to changed administrative practice or case law. Where legal bases are named in this information, these shall apply to the processing of personal data in their respective current version.
I can also provide this as a more polished legal English version for publication on a website.