Legal

Privacy Policy

Last updated: September 2026

This website collects personal data from its users.

The provider and controller is:
baoo Technologies GmbH
c/o Projekton
Salierring 32
50677 Cologne
Germany
Email: hi@yourhomie.ai

I. Foreword

We, baoo Technologies GmbH (hereinafter: the company, we or us), take the protection of your personal data seriously and would like to inform you here about data protection within our company.

Within the scope of our data protection responsibility, the entry into force of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: GDPR) has imposed additional obligations on us to ensure the protection of the personal data of the person affected by processing.

Insofar as we decide, either alone or jointly with others, on the purposes and means of data processing, this includes above all the obligation to inform you transparently about the nature, scope, purpose, duration and legal basis of the processing (cf. Art. 13 and Art. 14 GDPR). With this statement (hereinafter: privacy notice) we inform you of the manner in which your personal data is processed by us.

II. General information

1. Definitions

Following the model of Art. 4 GDPR, this privacy notice is based on the following definitions:

„Personal data“ (Art. 4(1) GDPR) is any information relating to an identified or identifiable natural person („data subject“). A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by reference to information about their physical, physiological, genetic, mental, economic, cultural or social identity.

„Processing“ (Art. 4(2) GDPR) is any operation in which personal data is handled, whether or not by automated means. This includes in particular the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction of personal data.

„Controller“ (Art. 4(7) GDPR) is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

„Processor“ (Art. 4(8) GDPR) is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

„Consent“ (Art. 4(11) GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

2. Changes to the privacy notice

As part of the further development of data protection law and technological or organisational changes, our privacy notice is reviewed regularly for the need for adaptation or supplementation. You will be informed of any changes.

3. No obligation to provide personal data

We do not make the conclusion of contracts with us dependent on you providing us with personal data in advance. As a customer, you are generally under no statutory or contractual obligation to provide us with your personal data; however, it may be that we can only provide certain offers to a limited extent or not at all if you do not provide the data required for this.

4. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as requests you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from „http://“ to „https://“ and by the lock symbol in your browser line. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

III. Information about the processing of your data

1. The collection of personal data concerning you

When you use our website, we collect personal data about you.

Personal data is all data that relates to you personally. For example, your name, your IP address, the device identifier, your address and email address are personal data. Your fingerprint, images, videos, audio recordings, but also your user behaviour, fall into this category.

2. Legal bases for data processing

By law, in principle every processing of personal data is prohibited and only permitted if the data processing falls under one of the following grounds for justification:

  • Art. 6(1)(a) GDPR („consent“)
  • Art. 6(1)(b) GDPR (performance of a contract / pre-contractual measures)
  • Art. 6(1)(c) GDPR (legal obligation)
  • Art. 6(1)(d) GDPR (vital interests)
  • Art. 6(1)(e) GDPR (public interest)
  • Art. 6(1)(f) GDPR („legitimate interests“)

For the processing operations we carry out, we indicate the applicable legal basis in each case below.

3. Hosting by Vercel and server log files

We host our website with the provider Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

When you visit our website, Vercel automatically records so-called server log files. These include: IP address, browser type and version, operating system used, referrer URL, host name of the accessing computer and the time of the server request. This data is not merged with other data sources.

The collection of this data is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the technically error-free presentation and optimisation of our website – for this, the server log files must be recorded.

Data transfer to the USA: Vercel is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection. In addition, we have concluded a data processing agreement (DPA) with Vercel pursuant to Art. 28 GDPR.

4. Data collected during use

We collect and process the following data about you:

  • Device information: IP address, device ID, device type, device-specific settings, date and time of access, time zone, the amount of data transferred, browser type and operating system (Art. 6(1)(b) or (f) GDPR).
  • Form data: data you provide to us, e.g. when booking an appointment (name, email address).
  • Information with your consent: we process other information (e.g. GPS location data) if you expressly permit us to do so (Art. 6(1)(a) GDPR).
  • Contact form data: when using contact forms, the transmitted data is processed (e.g. name, email address, company) in order to be able to handle your request (Art. 6(1)(f) GDPR).

5. Use of cookies

When operating our website, we use cookies. Cookies cannot run programs or transmit viruses to your device. They serve to make our website more user-friendly and effective overall.

A distinction is made between session cookies, which are deleted again as soon as you close the website, and persistent cookies, which are stored beyond the individual session. With regard to their function, a distinction is made between:

  • Technical cookies: strictly necessary for basic functions and the security of the website.
  • Performance cookies: collect anonymous information about how you use our website.
  • Advertising / targeting cookies: serve to offer needs-based advertising (stored for a maximum of 3 months).
  • Sharing cookies: improve interactivity with other services (stored for a maximum of 1 month).

Any use of cookies that is not strictly technically necessary constitutes data processing that is only permitted with your express and active consent pursuant to Art. 6(1)(a) GDPR.

6. Consent management (Cookiebot)

This website uses the cookie consent technology of Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark) to obtain your consent to the storage of certain cookies and tracking technologies and to document this in a data-protection-compliant manner.

When you enter our website, a connection is established to Cookiebot's servers in order to obtain your consent. Cookiebot then stores a cookie in your browser in order to attribute the consent given or its withdrawal to you.

We have concluded a data processing agreement (DPA) with the provider pursuant to Art. 28 GDPR.

Legal basis: Art. 6(1)(c) GDPR (legal obligation) as well as Art. 6(1)(f) GDPR (legitimate interest).

Google Consent Mode v2 is implemented. By default, all consent categories are set to „denied“. Only after your active consent via the Cookiebot banner are the respective categories set to „granted“.

7. Google Tag Manager

This website uses Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager itself does not create user profiles, store cookies or carry out any independent analyses. It merely serves to manage and deploy the tools integrated through it.

The tools integrated via Tag Manager are only activated after your consent via the cookie banner (where consent is required). We have concluded a data processing agreement (DPA) with Google pursuant to Art. 28 GDPR.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient tag management). Further information: Google Privacy Policy.

8. LinkedIn Insight Tag

This website uses the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit our website, a connection is established to LinkedIn's servers. LinkedIn is informed that you have visited our website. LinkedIn can attribute your visit to your LinkedIn account if you are logged in to LinkedIn.

We use the LinkedIn Insight Tag for conversion measurement and retargeting purposes.

The LinkedIn Insight Tag sets a cookie in your browser and enables LinkedIn to collect demographic data about the visitors to our website (e.g. industry, career level, company size). From this we only receive aggregated, non-personal reports. Individual identification of specific users is not possible for us.

In addition, a tracking pixel (<noscript> fallback) is embedded in the body of our website, which establishes a connection to LinkedIn servers if JavaScript is disabled.

The tool is only activated after your consent via the cookie banner. Legal basis: Art. 6(1)(a) GDPR (consent). Further information: LinkedIn Privacy Policy. You can object to the analysis of your usage behaviour by LinkedIn at LinkedIn Opt-Out.

9. YouTube content and YouTube fonts

YouTube preview images (thumbnails)

Preview images (thumbnails) of YouTube videos are embedded on our website. The images are loaded from Google's (YouTube's) servers (img.youtube.com). When these images are loaded, your IP address is transmitted to Google. Google may set cookies and use the IP address for its own purposes.

YouTube videos (enhanced privacy mode)

We embed YouTube videos via the domain youtube-nocookie.com (enhanced privacy mode). Videos are only loaded after you actively click the play button. Only then is data transmitted to YouTube / Google.

Google fonts via YouTube

When loading YouTube content (thumbnails and embedded videos), Google fonts may be loaded from Google's servers (fonts.googleapis.com, fonts.gstatic.com). In this process, your IP address is transmitted to Google servers. We have no influence over what data Google collects in this context and what Google uses this data for.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the appealing presentation of video content) or Art. 6(1)(a) GDPR (consent), where consent has been given via the cookie banner. Further information: Google Privacy Policy.

10. Newsletter and forms (HubSpot)

For newsletter sign-up and contact forms on our website, we use HubSpot (HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA). When signing up or using a form, the data you enter (e.g. first name, last name, email address, company where applicable) is transmitted to HubSpot and stored there.

HubSpot uses cookies to analyse user interactions with our forms and our website. These include in particular the HubSpot tracking cookie (__hs_opt_out, __hs_do_not_track, hubspotutk) as well as other functional cookies. These cookies are only set after your consent via the cookie banner.

Data transfer to the USA: HubSpot is certified under the EU-US Data Privacy Framework. In addition, we have agreed a data processing agreement (DPA) pursuant to Art. 28 GDPR as well as Standard Contractual Clauses (SCC) with HubSpot in order to ensure an adequate level of data protection.

Legal basis: Art. 6(1)(a) GDPR (consent for newsletter sign-up) or Art. 6(1)(b) GDPR (performance of a contract for contact requests) as well as Art. 6(1)(f) GDPR (legitimate interest in the efficient handling of requests). Further information: HubSpot Privacy Policy.

11. Visitor identification (Leadinfo)

This website uses Leadinfo (Leadinfo B.V., Rotterdam, Netherlands). Based on IP addresses and publicly available company data, Leadinfo identifies which companies visit our website. No personal data of individual persons is recorded in this process – the attribution is made exclusively at company level.

Leadinfo uses cookies to record page views and the navigation behaviour of company visitors. These cookies are only set after your consent via the cookie banner.

The recorded data (pages visited, time spent, company name, industry, and, where applicable, company contact data from public sources) is displayed in our Leadinfo dashboard and serves to identify potential business customers.

Data transfer: Leadinfo processes data within the EU/EEA. We have concluded a data processing agreement (DPA) with Leadinfo pursuant to Art. 28 GDPR.

Opt-out: company visitors can object to the recording at leadinfo.com/en/legal/opt-out.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in identifying and approaching potential business customers). Further information: Leadinfo Privacy Policy.

12. Data storage period

We delete your personal data as soon as it is no longer required for the purposes for which we collected or used it. As a rule, we store your personal data for the duration of the usage or contractual relationship. Your data is generally stored via our HubSpot CRM.

However, storage may take place beyond the specified period in the event of a (threatened) legal dispute with you or other legal proceedings. Statutory requirements for the retention and deletion of personal data remain unaffected by this (e.g. § 257 HGB or § 147 AO).

13. Data security

We use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

14. No automated decision-making

We do not intend to use personal data collected from you for any automated decision-making procedure (including profiling).

15. Change of purpose

Processing of your personal data for purposes other than those described will only take place insofar as a legal provision permits this or you have consented to the changed purpose of the data processing. In the event of further processing for other purposes, we will inform you of these other purposes before the further processing.

IV. Responsibility for your data and contacts

1. Controller and contact details

The body responsible for the processing of your personal data within the meaning of Art. 4(7) GDPR is us:

baoo Technologies GmbH
c/o Projekton Immobilien GmbH
Salierring 32
50677 Cologne
Germany
Email: hi@yourhomie.ai

Data protection officer:
Maximilian Mertin, Intersoft Consulting
Email: mmertin@intersoft-consulting.de

2. Data collection when contacting us

When you contact us by email or via a contact form, your email address, your name and all other personal data you have provided in the course of making contact are stored by us so that we can contact you to answer your question.

We delete this data as soon as storage is no longer necessary. If statutory retention periods apply, the data remains stored, but we restrict the processing.

V. Data processing by third parties

1. Commissioned data processing

It may happen that commissioned service providers are used for individual functions of our website. These act only on our instructions and have been contractually obliged within the meaning of Art. 28 GDPR to comply with data protection provisions.

The following categories of recipients may receive access to your personal data:

  • Service providers for the operation of our website and the processing of the data stored or transmitted by the systems (Art. 6(1)(b) or (f) GDPR).
  • Government bodies/authorities, insofar as this is necessary to fulfil a legal obligation (Art. 6(1)(c) GDPR).
  • Persons engaged to carry out our business operations (Art. 6(1)(b) or (f) GDPR).

2. Conditions for transferring personal data to third countries

In the context of our business relationships, your personal data may be passed on to third-party companies. These may also be located outside the European Economic Area (EEA). Where this is the case, we ensure that data protection is adequately guaranteed by standard contractual clauses, adequacy decisions or recognised certifications.

Among others, we use services of Google companies based in the USA. We have concluded the standard contractual clauses issued by the Commission. The standard contractual clauses can be viewed here: Google SCC.

3. Legal obligation to transmit certain data

Under certain circumstances, we may be subject to a special legal obligation to make lawfully processed personal data available to third parties, in particular public bodies (Art. 6(1)(c) GDPR).

VI. Your rights

1. Right of access

You have the right vis-à-vis us, within the scope of Art. 15 GDPR, to obtain information about the personal data concerning you. This requires an application to be sent by email or post to the addresses stated above.

2. Right to object to data processing

Pursuant to Art. 21 GDPR, you have the right to object at any time to the processing of personal data concerning you. We will cease the processing of your personal data unless we can demonstrate compelling legitimate grounds for the processing.

3. Withdrawal of consent

Pursuant to Art. 7(3) GDPR, you have the right to withdraw at any time consent you have given. This has the consequence that we may no longer continue the data processing based on this consent for the future.

4. Right to rectification and erasure

Insofar as personal data concerning you is inaccurate, you have the right pursuant to Art. 16 GDPR to demand that we rectify it without undue delay. Under the conditions set out in Art. 17 GDPR, you have the right to demand the erasure of personal data concerning you.

5. Right to restriction of processing

In accordance with Art. 18 GDPR, you have the right to demand that we restrict the processing of your personal data.

6. Right to data portability

In accordance with Art. 20 GDPR, you have the right to receive from us the personal data concerning you that you have provided to us in a structured, commonly used, machine-readable format.

7. Right to lodge a complaint with the supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint about the collection and processing of your personal data with the competent supervisory authority. You can find the competent supervisory authority at bfdi.bund.de.