Privacy Policy of GG Magazine

Privacy Policy of GRUND GENUG Verlag und Werbe GmbH

Most important information first:

You may at any time, with future effect, revoke in whole or in part your consent and settings configured via our Consent Management Platform when visiting our websites www.gg-magazine.com including all subpages (hereinafter collectively referred to as our “Website”). To do so, please use the corresponding menu item for managing “Cookie Settings” at the bottom of the Website.

For information on the use of cookies and other tracking technologies (“trackers”), the processing of personal data in this context, consent, and potential revocation, please refer to our “Cookie Policy”.

This Privacy Policy bears version number 2026_v1 and is valid from [insert date, e.g. September 11, 2026].

I. Data Controller and Your Rights as Data Subject *

*(Gender Notice: For reasons of better readability, simultaneous use of masculine, feminine, and diverse (m/f/d) language forms is omitted. All subsequent designations of persons apply equally to all genders.)

1. Data Controller

The controller responsible for data processing governed by this Privacy Policy is GRUND GENUG Verlag und Werbe GmbH (hereinafter also "GG Magazine", "Publisher", "we", or "us"). Our contact details are:

GRUND GENUG Verlag und Werbe GmbH
Vancouverstraße 2a
20457 Hamburg, Germany
Email: info@gg-magazine.com

2. Data Protection Officer

If you have questions regarding this Privacy Policy or data protection, please contact our Data Protection Officer:

Dr. Stefanie Wegener
Mittelweg 10
20148 Hamburg, Germany
Email: swegener@wegener-ra.de

3. Your Rights as Data Subject

You have the following rights as a data subject:

You have the right to obtain information regarding the processing of your personal data (for example, the source of this data, the purpose of processing, and processing modalities). Furthermore, under certain conditions, you are entitled to object to data processing for the future, restrict it, or request erasure of the data. Finally, you may at any time prevent the dispatch of advertising material or commercial communications.

In summary, you have the right to:

• Information / Access,

• Rectification,

• Erasure (or to be forgotten),

• Restriction of processing,

• Data portability,

• Object to the processing of your personal data,

• Lodge a complaint with supervisory authorities.

Furthermore, you have the right to object at any time to the processing of your personal data for direct marketing purposes. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.

Pursuant to Art. 7 (3) of the EU General Data Protection Regulation (hereinafter “GDPR”), you may withdraw consent previously granted to us at any time. Consequently, we may no longer continue the data processing based on that consent in the future.

Please note that your right to erasure is subject to restrictions. For example, we must not or cannot erase data that we are required to retain due to statutory retention periods. Data required for the establishment, exercise, or defense of legal claims is also excluded from your right to erasure.

If you have a complaint about how we process your data, you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

In the event of a statutory obligation, we reserve the right to disclose information about you if disclosure is requested by lawfully acting authorities or law enforcement agencies. Legal basis: Art. 6 (1) sentence 1 lit. c GDPR (legal obligation).

Overview of Our Data Processing Activities

The following Privacy Policy is structured as follows and provides an overview of the following data processing activities:

• Collection and processing of personal data when visiting our website

• Contact via our contact form

• Use of the ordering function for GG Magazine

• Storage and deletion of your data

I. Collection and Processing of Personal Data When Visiting Our Website

1. What data we process about you (hereinafter also "you" or "user")

By using our website, we process personal data, specifically:

We generally process personal data only to the extent you transmit it to us via the contact forms located on our corporate site. Personal data is processed only if you have granted us consent or if processing is permitted by statutory provisions. For certain services offered on our corporate site, we require a minimum amount of data. Mandatory fields are marked with an "asterisk". Without mandatory details, we cannot provide the services so marked.

Email address, first name, last name, address, telephone number — hereinafter referred to as "data" or "personal data" — provided by you when using individual services offered by us or an Engel & Völkers entity via our website (e.g., within contact inquiries and newsletter mailings); mandatory fields are marked with an "asterisk", optional fields with "(optional)";

Personal data (hereinafter also referred to as "user data") transmitted by the user's internet browser each time they access the website and stored in log files (also known as server log files). This data includes: IP address (Internet Protocol address) of the accessing computer; name of the accessed page; date and time of access; URL from which the user accessed the page; volume of transferred data; status message for successful access; session ID number;

Personal data in the form of location data (GPS data, "Locate Me" function) transmitted by your internet browser whenever you have enabled this setting either generally in the browser or on an application basis.

2. Purpose of Processing
We process personal data of users of our website for the following purposes:

• Fulfilling contact inquiries (legal basis is contract performance and — in the case of forwarding user data to other license partners of the Engel & Völkers Group (for definition see Section 3 below) — your consent);

• Contact by telephone by us (legal basis is contract performance or, if the phone number is used for promotional purposes, your consent);

• Sending email newsletters regarding our own offers as well as first-party and third-party advertising to the extent permitted by law or based on consent (legal basis is either your consent or our legitimate interest in direct marketing, provided marketing complies with data protection and competition law requirements);

• Provision of this online offer. Legal basis is the Publisher's legitimate interest (Art. 6 (1) sentence 1 lit. f GDPR) in the error-free display, security, and optimization of our website;

• Ensuring functionality and optimizing the website (legal basis is Engel & Völkers' legitimate interest in continuously improving website quality and ensuring ease of use);

• If applicable, identifying and blocking users who have installed an ad blocker and thereby block advertising (legal basis is Engel & Völkers' legitimate interest in providing fully or partially ad-financed content to users who do not block ads);

• Preventing fraudulent activity or abuse on or in connection with the website, and ensuring legal requirements for a secure website are met (legal basis is Engel & Völkers' legitimate interest in remedying disruptions, ensuring system security, and detecting unauthorized access attempts or access).

We process personal data transmitted in connection with our reporting feature to evaluate reported content, respond to potential violations of statutory provisions or our Terms of Use, and implement legally required measures.

(Legal basis is Regulation (EU) 2022/2065 (Digital Services Act), whose obligations we must comply with.)

For a description of usage-based data processing related to cookies and other tracking technologies, please see the "Cookie Policy" of:

Engel & Völkers GmbH
Vancouverstraße 2a
20457 Hamburg, Germany
Email: contact@engelvoelkers.com

You can find the Cookie Policy in the footer area of our corporate website.

In summary:

The legal basis for processing personal data is Art. 6 (1) sentence 1 lit. a GDPR if processing is based on consent, Art. 6 (1) sentence 1 lit. b GDPR if based on a (pre-)contractual relationship, and Art. 6 (1) sentence 1 lit. f GDPR if based on our legitimate interest. Where processing is necessary to fulfill a legal obligation to which we are subject, Art. 6 (1) sentence 1 lit. c GDPR serves as the legal basis.

Where consent is the legal basis, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal. Where legitimate interest is the legal basis, you are generally entitled to object at any time on grounds relating to your particular situation to the processing of personal data concerning you. Art. 21 GDPR applies in this regard.

3. Disclosure of Your Personal Data

Due to the scale and complexity of data processing within the Engel & Völkers Group, it is not possible to list every recipient of your personal data individually in this Privacy Policy; therefore, categories of recipients are generally specified.

Within the Engel & Völkers Group, data is disclosed to those Engel & Völkers entities or departments that require it to fulfill our contractual and legal obligations and to pursue legitimate interests within the scope of this website offer or based on your consent. This includes Engel & Völkers companies assisting with website provision, direct marketing, other IT infrastructure, hosting webinar events, property valuations, or newsletter delivery.

Your personal data is generally disclosed to third parties (i.e., companies not belonging to Engel & Völkers entities or the Engel & Völkers Group) only insofar as necessary for contract performance, where we or the third party have a legitimate interest in disclosure, where a legal obligation exists, or where your consent has been provided. If data is transferred to third parties based on a legitimate interest, this is explained in these privacy provisions. Third parties to whom we may transfer personal data, independent of service provision, include external advisors (e.g., lawyers and auditors), authorities within their competence to fulfill legal obligations and/or protect our rights (e.g., tax authorities, police, public prosecutors, courts), and/or other third parties to the extent you instruct us to transfer data or provide consent.

In summary:

If your contact inquiry concerns offers from other companies within the Engel & Völkers Group ("Engel & Völkers Entities"), Engel & Völkers transfers the personal data entered by you to the respective company based on a legitimate interest within the Engel & Völkers Group.

If your contact inquiry concerns offers from other companies in the broader Engel & Völkers network (i.e., our license partners), we disclose your personal data outside the core group only upon receiving your prior consent.

4. Transfer of Data to Non-EEA Countries

In addition to the section "Disclosure of Your Personal Data" above, the following applies:

Recipients of personal data may be located outside the EEA/UK. When personal data is transferred outside the EEA/UK, we will ensure, as required by law, that your data protection rights are adequately protected — either because the European Commission has decided that the country guarantees an adequate level of protection (Art. 45 GDPR) or because the transfer is subject to appropriate safeguards (e.g., Standard Contractual Clauses) agreed upon with the recipient (Art. 46 GDPR), unless an exemption applies under Art. 49 GDPR. In addition, where necessary, we intend to agree on supplementary measures with recipients to ensure an adequate level of data protection.

Copies of appropriate safeguards (where relied upon) and a list of recipients outside the EEA/UK may be requested. Please note that such copies may be redacted to the extent necessary to protect trade secrets or other confidential information.

Insofar as personal data is processed within AI-assisted searches, transfer and processing (specifically storage) by a recipient in a third country outside the European Union or European Economic Area may occur. In such cases, we cannot guarantee that statutory requirements for such processing are met.

II. Contact via Our Contact Form

1. What Data We Process About You

When you contact us using the contact form provided on our website, we process the personal data you enter. This generally includes:

• First name, last name, email address, and message content. Mandatory fields are marked with an "asterisk".

• Optional fields may include telephone number or additional details regarding your request, if voluntarily provided.

2. Purpose of Processing

We process this data for the following purposes:

• Fulfilling user contact requests made to GG Magazine. Legal basis is contract performance or implementation of pre-contractual measures (Art. 6 (1) sentence 1 lit. b GDPR) if your inquiry aims at concluding a contract (e.g., ad booking, cooperation). In all other cases, processing is based on our legitimate interest (Art. 6 (1) sentence 1 lit. f GDPR) in effectively and quickly processing inquiries addressed to us, or on your consent (Art. 6 (1) sentence 1 lit. a GDPR).

3. Disclosure of Your Personal Data

Your personal data is generally disclosed to third parties (companies not belonging to Engel & Völkers entities or the Engel & Völkers Group) only insofar as necessary for contract performance, where we or the third party have a legitimate interest, where a legal obligation exists, or where your consent has been provided. If data is transferred to third parties based on a legitimate interest, this is explained in these privacy provisions. Third parties include external advisors (e.g., lawyers, auditors), authorities within their competence (e.g., tax authorities, police, public prosecutors, courts), and/or other third parties upon your instruction or consent.

In summary:

If your contact inquiry concerns offers from other companies of the Engel & Völkers Group ("Engel & Völkers Entities"), Engel & Völkers transfers the personal data entered by you to the respective company based on a legitimate interest within the Engel & Völkers Group.

4. Transfer of Data to Non-EEA Countries

In addition to the section "Disclosure of Your Personal Data" above, the following applies:

Recipients of personal data may be located outside the EEA/UK. When personal data is transferred outside the EEA/UK, we will ensure, as required by law, that your data protection rights are adequately protected, either because the European Commission has decided that the country guarantees an adequate level of protection (Art. 45 GDPR) or because the transfer is subject to appropriate safeguards (e.g., Standard Contractual Clauses) agreed upon with the recipient (Art. 46 GDPR), unless an exemption applies under Art. 49 GDPR. In addition, where necessary, we intend to agree on supplementary measures with recipients to ensure an adequate level of data protection.

III. Use of the Ordering Function for GG Magazine

1. What Data We Process About You

When you use the ordering function on our website to purchase GG Magazine (e.g., as a subscription or single copy), we collect and process data necessary for contractual execution. This includes:

• First name, last name, delivery and billing address, email address, language, and (optional) telephone number.

• Payment data, depending on your chosen payment method (e.g., bank details for direct debits).

2. Purpose of Processing

We process this data for the following purposes:

• Processing your magazine order, smooth delivery of print or digital editions, invoicing, and payment processing. Legal basis is performance of the contract concluded with you pursuant to Art. 6 (1) sentence 1 lit. b GDPR.

• To process payments, we forward necessary payment data to the payment service provider or credit institution commissioned by you. This transfer is likewise based on contract performance (Art. 6 (1) sentence 1 lit. b GDPR).

• Compliance with commercial and tax law retention obligations. Legal basis is our legal obligation (Art. 6 (1) sentence 1 lit. c GDPR).

3. Disclosure of Your Personal Data

Within the Engel & Völkers Group, data is received by those Engel & Völkers entities or departments that require it to fulfill contractual and legal obligations and to pursue legitimate interests within the scope of this website offer or based on your consent. This includes Engel & Völkers entities assisting with website provision, IT infrastructure, or newsletter delivery.

Your personal data is generally disclosed to third parties (companies outside Engel & Völkers entities and the Engel & Völkers Group) only insofar as necessary for contract performance, where we or the third party have a legitimate interest, where a legal obligation exists, or where your consent has been provided. Third parties include external advisors (e.g., lawyers, auditors), authorities within their competence (e.g., tax authorities, police, public prosecutors, courts), and/or other third parties upon your instruction or consent.

4. Transfer of Data to Non-EEA Countries

In addition to the section "Disclosure of Your Personal Data" above, the following applies:

Recipients of personal data may be located outside the EEA/UK. When personal data is transferred outside the EEA/UK, we will ensure, as required by law, that your data protection rights are adequately protected, either because the European Commission has decided that the country guarantees an adequate level of protection (Art. 45 GDPR) or because the transfer is subject to appropriate safeguards (e.g., Standard Contractual Clauses) agreed upon with the recipient (Art. 46 GDPR), unless an exemption applies under Art. 49 GDPR. In addition, where necessary, we intend to agree on supplementary measures with recipients to ensure an adequate level of data protection.

Copies of appropriate safeguards (where relied upon) and a list of recipients outside the EEA/UK may be requested. Please note that such copies may be redacted to the extent necessary to protect trade secrets or other confidential information.

IV. Storage and Deletion of Your Data

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, unless statutory retention periods (e.g., under the German Commercial Code or Tax Code) mandate longer storage. For example, contract-related accounting documents from the ordering function are stored for eight years. Upon cessation of the respective purpose or expiration of applicable retention periods, data is routinely blocked or erased in accordance with statutory regulations.