1. Data protection at a glance

General information

The following information gives a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information on data protection can be found in the privacy policy set out below.

Data collection on this website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

How do we collect your data?
Some of your data is collected when you provide it to us. This may, for example, be data that you enter in a contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page request). This data is collected automatically as soon as you enter this website.

What do we use your data for?
Part of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour. Where contracts can be concluded or initiated via the website, the transmitted data is also processed for contract offers, orders or other enquiries.

What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and any other questions on data protection.

Analytics tools and third-party tools

We use no analytics or tracking programs on this website. Your browsing behaviour is not statistically evaluated, no reach measurement takes place and no profiles are created. Only services that are necessary for operation are integrated – they are listed individually in this policy.

2. Hosting

We host the content of our website with the following provider: Hostinger

External hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the host(s). This may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access and other data generated via a website.

External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6(1)(f) GDPR). Where consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act), insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

Our host(s) will only process your data to the extent necessary to fulfil their service obligations and will follow our instructions with regard to this data.

We use the following host(s): Hostinger

3. General information and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller responsible for data processing on this website is:

Thomas Tergan
Großenhainer Straße 98
01127 Dresden, Germany

Phone: +49 176 20085225
Email: info@sustainabim.com

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses or similar).

Storage period

Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons cease to apply.

General information on the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data under Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is additionally based on Section 25(1) TDDDG. Consent can be withdrawn at any time. If your data is required for the performance of a contract or for pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest under Art. 6(1)(f) GDPR. The relevant legal bases in each individual case are explained in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our business activities we work with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary to perform a contract, if we are legally obliged to do so (e.g. passing data to tax authorities), if we have a legitimate interest under Art. 6(1)(f) GDPR in passing it on, or if another legal basis permits the disclosure. When using processors, we only pass on our customers’ personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint controllership agreement is concluded.

Specifically, we work with the following service providers:

• Hostinger (hosting, database, email mailbox) – Hostinger International Ltd., Cyprus
• Stripe (payment processing) – Stripe Payments Europe, Ltd., Ireland
• Bunny Stream (delivery of course videos) – BunnyWay d.o.o., Slovenia
• Google (calendar for appointment management) – Google Ireland Limited, Ireland
• OpenStreetMap Foundation (map display, only after your click) – United Kingdom

In addition, we pass on data to our tax advisor and to the tax authorities where required by law.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged breach. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right at any time to receive information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. You can contact us at any time regarding this and other questions about personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
• If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may – apart from its storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the address bar of the browser changing from “http://” to “https://” and by the lock symbol in your browser bar.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address.

This data is not combined with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – for this purpose, the server log files must be recorded.

Cookies

Our website uses so-called “cookies”. Cookies are small data packets and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies).

We use only technically necessary cookies. No cookies are used for analytics, advertising or tracking purposes, and nothing is passed on to third parties. For this reason, no consent banner is required to operate this website.

Specifically, this concerns:

• sb_kurse – login cookie of the course area at kurse.sustainabim.com. It contains your user ID and your email address in signed form and keeps you logged in. Duration: 30 days. It is only set when you log in and is protected against being read by scripts (httpOnly). It is deleted when you log out.

This cookie is stored on the basis of Section 25(2) No. 2 TDDDG, as it is strictly necessary to provide the service you have expressly requested. The associated data processing is based on Art. 6(1)(b) GDPR.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent.

The following is transmitted: name, email address, optionally a phone number and your message. The enquiry is delivered to our mailbox info@sustainabim.com; in addition, you receive a confirmation of receipt at the address you provided. The form content is not stored in a database.

To protect against automated mass mailing, we limit the number of enquiries per sender. For this purpose, your IP address is not stored in plain text, but only kept as a non-reversible check value (SHA-256) for a maximum of one hour. The form also contains a field that is invisible to you and is only filled in by automated scripts.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested; consent can be withdrawn at any time.

The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Enquiries by email or phone

If you contact us by email or phone, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested.

The data you send to us via contact enquiries remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies.

Appointment booking

Via our appointment page you can request a video call, a phone call or a site visit. In doing so, we process: name, email address, the desired time and type of appointment and – depending on the type of appointment – your phone number (for a phone call) or the property address (for a site visit) as well as your request as free text. This data is stored in our database.

Processing is carried out to implement pre-contractual measures at your request (Art. 6(1)(b) GDPR). Without this information we cannot hold the appointment.

Transfer to Google: We use Google Calendar to manage appointments. When displaying available times, we already query Google as to which periods are occupied in our calendar; no data of yours is transmitted in this process. As soon as we confirm your request, a calendar entry is created containing your name, your email address, the type of appointment and – if provided – phone number, property address and your request. For video calls, Google also generates a Meet link. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework. Details: policies.google.com/privacy.

For every request you receive a confirmation by email with a link through which you can cancel the appointment yourself at any time. If you cancel or we cancel, the calendar entry is removed again. We delete appointment requests as soon as they are no longer required for initiating or handling the matter, at the latest after statutory retention periods have expired.

5. Course area and customer account

Our video courses are provided via a separate members’ area at kurse.sustainabim.com. The following sections apply to this area.

Account and login

An account is required to access purchased courses. For this purpose, we store your email address, a first name of your choice (only if you write in the community), the time the account was created and the time of your last login.

Login takes place without a password: you receive a six-digit one-time code by email. This code is only stored by us as a non-reversible check value (SHA-256), expires after 30 minutes and is invalidated after use. Failed attempts and the time of the request are logged to prevent brute-force guessing.

The legal basis is Art. 6(1)(b) GDPR (performance of the purchase contract for the course).

Payment processing via Stripe

We process purchases via the payment service provider Stripe. The provider for customers within the EEA is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When you make a purchase, you are redirected to a payment page operated by Stripe. You enter your payment data – in particular card numbers – exclusively there; it never reaches our servers. Stripe processes, under its own responsibility, among other things your payment data, your email address, the invoice amount and technical features such as IP address and device data to prevent fraud.

For each purchase we receive back from Stripe: the payment ID, your email address, the purchased course, the amount, the currency and the payment status. We store this information to assign your course access and to fulfil our retention obligations under commercial and tax law.

The legal basis is Art. 6(1)(b) GDPR. A transfer to the USA cannot be ruled out; Stripe is certified under the EU-US Data Privacy Framework, see dataprivacyframework.gov. Further information: stripe.com/privacy.

Video delivery via Bunny Stream

The course videos are delivered via Bunny Stream, a service of BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia.

When you play a video, the player is loaded from the provider’s servers. Bunny receives your IP address, technical information about your browser and device and information about the video accessed. Access takes place via time-limited, signed addresses, so videos cannot be accessed outside the members’ area. We ourselves do not receive any personal analyses from Bunny.

The legal basis is Art. 6(1)(b) GDPR, as providing the videos is an essential part of the contract. The provider is based in the EU; according to the provider, no transfer to third countries takes place. Further information: bunny.net/privacy.

Learning progress

If you mark a lesson as completed, we store this against your account so that you can continue from there on your next visit. Your learning behaviour is not analysed; in particular, playback times or drop-out rates are not measured. The legal basis is Art. 6(1)(b) GDPR.

6. Community

In the course area we operate a discussion area in which logged-in users can open and reply to topics.

What others see: For each post, only a first name, the time and the content are displayed. Your email address is never visible to other participants. You can also publish any post anonymously; the note “Anonymous” then appears instead of your first name.

What we see: Even with anonymous publication, the assignment of the post to your account remains stored in our database. This is necessary so that we can meet our responsibility for the content of our offer, remove unlawful posts and prevent misuse. “Anonymous” therefore means: anonymous towards other participants, not towards us as the operator. The legal basis for this is our legitimate interest in a lawful and moderated offer (Art. 6(1)(f) GDPR).

Access: The discussion area is currently only accessible to logged-in users; the areas for individual courses are only open to the respective course participants. These pages are blocked for search engines.

Your posts: You can delete your own posts yourself at any time. We remove posts that violate applicable law or our code of conduct. Please do not publish any personal data of third parties there, in particular no addresses of other people’s properties. The legal basis for publishing your posts is Art. 6(1)(b) GDPR in conjunction with your use of the offer.

Posts remain stored until you delete them, your account is deleted or we remove them. We apply a technical limit on the number of posts per hour to prevent mass publication.

7. Newsletter and free resources

On our website you can subscribe to our newsletter (“Baupost”, in German) and request free resources (checklists, guides). Both use the same procedure.

Registration by confirmation (double opt-in)

After signing up, you first receive an email with a confirmation link. Only when you click it do we add you to the mailing list and release a requested resource. Without this confirmation we send no advertising and deliver no file. This ensures that nobody can be registered with someone else’s address.

We store: your email address, the first name you voluntarily provide, the origin of the registration (which form or which resource), the time of registration and confirmation, and in each case your IP address only as a non-reversible hash value. The hash value serves solely as proof of consent; your IP address cannot be derived from it.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 7(2) No. 3 UWG (German Act against Unfair Competition). We store the proof data on the basis of our legitimate interest in documenting consent given (Art. 6(1)(f) GDPR).

Unsubscribing

You can withdraw your consent at any time with effect for the future. Every email contains an unsubscribe link for this purpose, which works with one click — without logging in and without further questions. Alternatively, an informal message to info@sustainabim.com is sufficient. After unsubscribing we send nothing more; your address remains stored in a blocked state so that we do not accidentally write to you again, and is deleted after statutory retention obligations have expired.

Performance measurement

Our newsletters contain a so-called tracking pixel — a small image file that is retrieved from our server when the email is opened. In addition, links contained in the email lead via a redirect on our own server. This allows us to see whether an email was opened and which link was clicked. We link this information to your registration in order to assess which topics are read. Unsubscribe, legal notice and privacy links are excluded from counting.

The legal basis is the consent you give when registering (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via the unsubscribe link; measurement then also ends. No data is transferred to third parties, and no profile is created that goes beyond opening and clicking.

Free resources

If you request a resource, we additionally store which file you requested, when access was released and whether the file was downloaded. The file is provided via a personal, cryptographically signed link. We use this information to enable the download and to see which resources are in demand. The legal basis is Art. 6(1)(b) GDPR for providing the requested file and your consent for receiving the newsletter.

Emails are sent via the mailbox of our hosting provider Hostinger. No external newsletter service provider is involved; your address does not leave our systems.

Phone number (optional)

When requesting a resource, you can optionally provide a phone number. We only store it if you additionally give explicit permission for us to call you to discuss your project. Without this permission the number is not stored. Together with the number we record the time of your permission, the wording you agreed to and your IP address as a non-reversible hash value. The number is not passed on to third parties.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) No. 1 UWG). You can withdraw it at any time with effect for the future — informally by email to info@sustainabim.com or during the call itself. Unsubscribing from the newsletter does not automatically end the permission to call; if you wish to end both, one sentence in your message is enough. As required by Section 7a UWG, we keep proof of your consent for five years from when it was given and after each use.

8. Integrated services

Map display (OpenStreetMap)

On our contact page we integrate a map from OpenStreetMap. The provider is the OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

The map is not loaded automatically. At first you only see a placeholder; only when you actively click on it is a connection to OpenStreetMap established. Your IP address is transmitted to the provider in the process. Without your click, no transmission whatsoever takes place.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give by clicking on the placeholder and which you can withdraw at any time with effect for the future by reloading the page and not activating the map again. An adequacy decision of the EU Commission exists for the United Kingdom. Further information: osmfoundation.org.

Fonts

This website uses the fonts “Geist” and “Public Sans”. Both are delivered exclusively from our own server. There is no connection to Google Fonts or other external font providers; your IP address is not transmitted to any third party for this purpose.

Sending emails

All emails that we send in connection with the contact form, appointment booking and the course area are sent via the mailbox of our hosting provider Hostinger. The newsletter and the free resources (section 7) are also sent via this mailbox. Your address is not passed on to external newsletter or marketing services.

9. Status of this policy

This privacy policy was last adapted to the actual scope of our offer in September 2026. If the services we use change, we will update it accordingly.