Privacy Policy

1. Controller and privacy contact

HypoTech GmbH, Josef-Anton-Gall-Straße 35, 71263 Weil der Stadt, Germany. Represented by Armin Satzger. Email: armin@hypo.tech.

Our external data protection officer is Nils Oehmichen, frag.hugo Informationssicherheit GmbH, Spaldingstraße 64-68, 20097 Hamburg, Germany. Telephone: 040 57308220-0. Email: info@fraghugo.de. You may contact him directly with any questions about the processing of your personal data or the exercise of your rights.

Further information:Contact the data protection officer by email

2. Website operation, AWS hosting, and security

The application, database, document storage, operational logs, and separate archive run on Amazon Web Services (AWS) in eu-central-1 (Frankfurt). AWS acts as our processor for these services.

When you access the service, we process in particular the IP address, time, requested address, response status, and browser and device details. This is necessary to deliver the service, diagnose errors, defend against attacks, and evidence secure operation. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

Operational and security logs are generally deleted after 30 days unless a specific security incident requires separately documented retention for longer.

Data is transmitted using TLS and encrypted at rest. Access is role-based and logged. These measures reduce risk but cannot guarantee absolute security.

Further information:AWS Privacy Notice

3. Account, contact, and mortgage application

We process personal data where necessary to create and use an account and to prepare and provide the requested brokerage service. The legal basis is Article 6(1)(b) GDPR. We process legally required evidence under Article 6(1)(c) GDPR.

When you contact us with a question, we process your contact details and the content of your request in order to respond. If the request concerns a brokerage service or steps before entering into it, the legal basis is Article 6(1)(b) GDPR; otherwise, it is Article 6(1)(f) GDPR based on our interest in handling incoming requests. We delete this data after the request has been resolved unless a retention duty or necessary limited documentation requires longer storage.

The privacy policy is linked where data is collected. Acknowledging it is not consent. Consent for optional marketing or partner disclosures is requested separately and can be withdrawn for the future.

Required fields are marked as such. Without the account, contact, or application details required for a particular step, we may be unable to provide the account, requested response, or brokerage service in whole or in part. Optional details are identified as such and do not affect access to unrelated functions.

Before we act as your credit intermediary, we send you our initial information (pre-contractual information under section 655a(2) of the German Civil Code) by email as a PDF. Until 19 November 2026 inclusive, you sign the brokerage mandate with your qualified electronic signature via Skribble; from 20 November 2026, you give it in text form in your financing request. You also receive the mandate by email as a PDF. We file both documents in your financing request and keep their version, checksum and the times of creation, sending and granting as evidence. For each applicant, we likewise record when the notices on the credit check were acknowledged and the release from banking secrecy was declared. The legal basis is Article 6(1)(b) and (c) GDPR.

Depending on the stage and content of your request, we process the following categories in particular:

• identity and contact details, such as name, date of birth, address, email address, and telephone number
• account and access data and information relating to sign-in and account security
• family, household, and employment information
• income, tax, asset, liability, and bank information
• information relating to SCHUFA or other credit agencies where you provide corresponding documents
• financing preferences and property, purchase price, and loan information
• uploaded evidence and property documents, communications, and case status

4. Documents and automated checking

Uploaded documents are stored encrypted in AWS Frankfurt. For text recognition, classification, legibility, and completeness checks, required document content is sent to Microsoft Azure OpenAI in the Azure EU Data Zone. Microsoft acts as a processor. Matching input segments can be cached technically for up to 24 hours within the EU Data Zone; content is not used to train foundation models.

The check supports casework but does not perform AI credit scoring, make a lending decision, automatically reject an applicant, or automatically submit a case to a bank. A person reviews results before any adverse, legal, or similarly significant effect. The legal basis is Article 6(1)(b) GDPR.

We make no SCHUFA enquiry ourselves; digital preparation and a non-binding rate comparison therefore do not trigger a SCHUFA enquiry. If you upload an existing SCHUFA report, we may record the score and information shown in it for completeness and plausibility checks. We do not calculate our own SCHUFA or AI score.

Lenders with which your financing is requested with your personal details – in a pre-inquiry or with the application – may, under their own responsibility, obtain information from SCHUFA and report data on the application for, performance and termination of the credit agreement to SCHUFA. The legal basis is Article 6(1)(b) and (f) GDPR; we do not ask for consent for this. A pre-inquiry without your name does not allow any information about you to be obtained. If you have released the lenders from banking secrecy in the self-disclosure, they may tell us the result of their credit check, including the result of a SCHUFA enquiry; we use it only to arrange your financing.

Further information:Microsoft Privacy Statement

5. AI question assistance and digital needs assessment

When using question assistance or the digital needs assessment, you interact with an AI system. Required prompts, conversation segments, structured application data, and selected cleaned document facts are processed by Microsoft Azure OpenAI in the Azure EU Data Zone. We do not use a global deployment.

Before an application is created, the question-assistance history generally remains in your browser session. It is stored with an application only if you expressly assign it or use the assistance within a case. We do not create a separate copy to train our own or third-party foundation models.

The AI explains steps, collects information, and flags matters for review. It does not produce AI credit scores, decide financing, automatically reject anyone, or automatically send a case to a bank. A person makes professional and legally or financially significant decisions. The legal basis is Article 6(1)(b) GDPR; for purely general optional questions, Article 6(1)(f) GDPR based on our interest in offering understandable guidance.

Further information:Microsoft Privacy Statement

6. Europace and lenders

For a non-binding rate comparison or technical preparation of a financing request, Europace AG, as operator of the brokerage platform, may receive the required household, property, financing, and contact data. Before the first full-case transfer, we identify Europace and the purpose in the flow and record the notice version. The legal basis is Article 6(1)(b) GDPR.

We send a full case to banks, insurers, building societies, or other lenders only where needed for the request you want and after coordination with you. The specific recipient is identified. Those recipients assess the application as independent controllers and make the lending decision. A displayed rate is neither loan approval nor an automatic bank submission.

Further information:Europace privacy policy

7. Project and partner disclosures

Property developers, sales partners, or brokers receive personal financing or document data only after your explicit consent to a specifically described disclosure or where another legal basis applies in an individual case. The consent names the recipient, data categories, and purpose and can be withdrawn for the future. Without it, income, assets, documents, lender terms, and conversation content remain hidden.

8. Scheduling and video calls

When you book an appointment, we process your name, email address, time, appointment type, and necessary messages through Google Calendar; a Google Meet link is created for video calls. Google acts as a processor for the Workspace services we use. The legal basis is Article 6(1)(b) GDPR. Without these details, the requested appointment cannot be arranged.

Further information:Google Privacy Policy

9. Electronic signature and archive

For electronic signatures, we send the document, names, email addresses, roles, and signature status to Skribble Deutschland GmbH through the German Skribble tenant. Skribble acts as a processor. The legal basis is Article 6(1)(b) GDPR; statutory documentation and retention duties rely on Article 6(1)(c) GDPR.

Signed advice and brokerage records are stored separately and immutably in the AWS archive in Frankfurt until 31 December of the fifth following year where the statutory duty applies.

Further information:Skribble privacy policy

10. Email delivery through Amazon SES in Frankfurt

We send transactional messages such as confirmations, invitations, and status notices through Amazon Simple Email Service (SES) in AWS region eu-central-1 (Frankfurt). Amazon Web Services EMEA SARL acts as processor. Recipient address, sender, subject, message content, and technically necessary delivery events are processed. Open and click tracking are disabled.

Our database does not retain recipient or message histories. It keeps only a technical dispatch ledger for 90 days to prevent duplicate delivery. Delivery events are converted into aggregated operational metrics without recipient addresses or content. The legal basis is Article 6(1)(b) GDPR, or Article 6(1)(c) GDPR for legally required messages.

Further information:AWS Privacy Notice

11. Cookies, analytics, and marketing

Strictly necessary storage supports sign-in, security, and your privacy selection. Analytics and marketing technologies are off by default and activate only after your consent under Article 6(1)(a) GDPR and section 25 TDDDG. The browser sends no PostHog request before that consent.

With analytics consent, we use PostHog with EU processing. We do not create person profiles, call identification functions, or send contact details, application identifiers, free text, or exact financial amounts. Analytics events are retained for 12 months.

Autocapture, session recording, error capture, heatmaps, and person profiles are disabled. We capture only explicitly defined, coarse process events. You can change your selection through “Privacy Settings” in the footer; withdrawal applies to future processing.

Further information:PostHog Privacy Policy

12. Retention and deletion

We retain active application and document data while processing the case. After bank submission is completed, it is generally deleted from the active system after 12 months unless continued processing, legal defence, or a statutory duty requires longer retention. For abandoned requests, we send a reminder after 60 days of inactivity and delete after 90 days unless a duty or documented exception applies.

Signed records subject to statutory retention remain in the locked archive until 31 December of the fifth following year. Security and error logs are retained under the approved deletion schedule only as long as needed for operation, attack detection, and evidence. Provider-specific periods appear in the relevant sections.

Where no fixed period can be stated, duration is determined by the continued purpose, limitation periods, statutory record-keeping duties, and the need to establish or defend legal claims. Data is then deleted or anonymised.

13. Data sources under Article 14 GDPR

We receive most data directly from you. If you provide data about household members or authorised representatives, their data comes from you; please inform them about this policy. Other data may come from a developer, sales partner, or broker you named, submitted documents, Europace results, and requested lenders. This mainly includes contact, project, property, household, financing, document, and case-status data.

With joint financing, the main applicant names the second applicant and manages the request for both. From the main applicant we receive the second applicant’s name, salutation and title, email address and employment, together with the declaration that the second applicant knows about and agrees to the request; later, the self-disclosure details and the documents uploaded for them are added. We inform the second applicant ourselves by email under Article 14 GDPR immediately after the request is created. They can contact us or our data protection officer at any time and exercise their rights under section 15. If they do not agree to the request, we stop processing their data for this request unless a statutory retention obligation applies.

14. Recipients and international transfers

Only personnel and service providers who need access for the stated purposes receive it. Recipient categories are IT and hosting providers, AI providers, communication and signature services, Europace, and the lenders specifically requested. Authorities receive data only where legally required.

AWS Frankfurt, the Azure EU Data Zone, PostHog EU, and the German Skribble tenant limit primary processing to the described European locations. Where third-country access may nevertheless occur, we use an adequacy decision or Standard Contractual Clauses and supplementary measures.

15. Your rights and complaints

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, data portability, and objection. You may withdraw consent at any time for the future. For processing under Article 6(1)(f) GDPR, you may object for reasons arising from your particular situation; you may always object to direct marketing.

You may request human review of AI-assisted results and state your point of view. hypotech does not make a solely automated decision with legal or similarly significant effects within Article 22 GDPR.

You may also complain to a data protection supervisory authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de). Please send privacy requests to our external data protection officer at info@fraghugo.de.

Further information:Baden-Württemberg data protection authorityContact the data protection officer by email