1. Data protection at a glance

General information

The following information gives a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information on data protection can be found in the privacy policy set out below.

Data collection on this website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

How do we collect your data?
Some of your data is collected when you provide it to us. This may, for example, be data that you enter in a contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page request). This data is collected automatically as soon as you enter this website.

What do we use your data for?
Part of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour. Where contracts can be concluded or initiated via the website, the transmitted data is also processed for contract offers, orders or other enquiries.

What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and any other questions on data protection.

Analytics tools and third-party tools

We use no third-party analytics or tracking services on this website and no cookies for reach measurement; no user profiles are created. We merely count anonymously on our server how often the individual pages of this website, of our free guides and of the course area are viewed and how often forms are submitted (requesting a guide, newsletter sign-up, contact enquiry, appointment request, redirection to checkout, completed purchase) – as a simple number per day and event (daily counters), without cookies, without storing your IP address and without any reference to you as a person. So that search engines, other programs and link previews are not counted, we check the browser identifier and language setting that your browser sends with every request anyway; this information is not stored.

We also record, in broad terms, where a visit comes from. For this purpose, we derive only a short label from the address of the referring website that your browser sends (referrer) – for example “google” or “linkedin”, or “direkt” (direct) if there is no referring website – or we take a campaign label from the link you opened (e.g. “?via=…” or “utm_source”). We do not store the full address, search terms or click identifiers (such as gclid or fbclid). The label is included in the daily counters and, within our website and course area, passed on in the address of links to course pages, appointment booking, the deadline check and guides. If you submit a form (guide, newsletter, contact form, appointment request) or buy a course, we store the label together with this information and for the same period; when you make a purchase, we also transmit it to our payment service provider Stripe together with the order data (section 5).

The legal basis is our legitimate interest in knowing which pages, guides and offers are in demand and how prospective customers find us (Art. 6(1)(f) GDPR). Your device is not accessed in the process – nothing is stored on it or read from it – so Section 25 TDDDG does not apply. For performance measurement in our newsletters, see section 7. Only services that are necessary for operation are integrated – they are listed individually in this policy.

2. Hosting

We host the content of our website with the following provider: Hostinger

External hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the host(s). This may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access and other data generated via a website.

External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6(1)(f) GDPR). Where consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act), insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

Our host(s) will only process your data to the extent necessary to fulfil their service obligations and will follow our instructions with regard to this data.

We use the following host(s): Hostinger

3. General information and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller responsible for data processing on this website is:

Thomas Tergan
Großenhainer Straße 98
01127 Dresden, Germany

Phone: +49 176 20085225
Email: info@sustainabim.com

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses or similar).

Storage period

Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons cease to apply.

General information on the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data under Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is additionally based on Section 25(1) TDDDG. Consent can be withdrawn at any time. If your data is required for the performance of a contract or for pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest under Art. 6(1)(f) GDPR. The relevant legal bases in each individual case are explained in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our business activities we work with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary to perform a contract, if we are legally obliged to do so (e.g. passing data to tax authorities), if we have a legitimate interest under Art. 6(1)(f) GDPR in passing it on, or if another legal basis permits the disclosure. When using processors, we only pass on our customers’ personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint controllership agreement is concluded.

Specifically, we work with the following service providers:

• Hostinger (hosting, database, email mailbox) – Hostinger International Ltd., Cyprus
• Stripe (payment processing) – Stripe Payments Europe, Ltd., Ireland
• Bunny Stream (delivery of course videos) – BunnyWay d.o.o., Slovenia
• Google (calendar for appointment management, Google Meet for video calls) – Google Ireland Limited, Ireland
• WhatsApp (question channel of the “Kein Groschengrab” guidance, only if you use it) – WhatsApp Ireland Limited, Ireland
• Cloud storage service (processor; exchange of documents in the “Kein Groschengrab” guidance) – we will name the provider at the start of the guidance
• OpenStreetMap Foundation (map display, only after your click) – United Kingdom

In addition, we pass on data to our tax advisor and to the tax authorities where required by law.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged breach. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right at any time to receive information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. You can contact us at any time regarding this and other questions about personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
• If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may – apart from its storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the address bar of the browser changing from “http://” to “https://” and by the lock symbol in your browser bar.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address.

This data is not combined with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – for this purpose, the server log files must be recorded.

Cookies

Our website uses so-called “cookies”. Cookies are small data packets and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies).

We use only technically necessary cookies. No cookies are used for analytics, advertising or tracking purposes, and nothing is passed on to third parties. For this reason, no consent banner is required to operate this website.

Specifically, this concerns:

• sb_kurse – login cookie of the course area at kurse.sustainabim.com. It contains your user ID and your email address in signed form and keeps you logged in. Duration: 30 days. It is only set when you log in and is protected against being read by scripts (httpOnly). It is deleted when you log out.

This cookie is stored on the basis of Section 25(2) No. 2 TDDDG, as it is strictly necessary to provide the service you have expressly requested. The associated data processing is based on Art. 6(1)(b) GDPR.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent.

The following is transmitted: name, email address, optionally a phone number, your role and the property details if provided, and your message; in addition the short label indicating where the visit came from (see section 1) and the language of the page on which you filled in the form.

Your details are first stored in our database and only then delivered to our mailbox info@sustainabim.com; as a rule, you also receive a confirmation of receipt at the address you provided. The sole purpose of storing them is the reliable handling of your enquiry: it ensures that your enquiry reaches us even if sending emails temporarily fails – an automated run then delivers it later. For this purpose we also record whether and when the two emails were delivered and how many delivery attempts there were.

To protect against automated mass mailing, we limit the number of enquiries per sender. For this purpose, your IP address is not stored in plain text, but only kept as a non-reversible check value (SHA-256) for a maximum of one hour. The form also contains a field that is invisible to you and is only filled in by automated scripts, and a signed timestamp (no cookie). If an enquiry suggests such misuse – for example because the timestamp is missing – we still forward it to ourselves but do not send a confirmation of receipt, so that our form cannot be used to send emails to uninvolved people; the same applies if an unusually high number of confirmations has just been sent to the same address or in total.

This data – including its storage in our database – is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested; consent can be withdrawn at any time.

We delete the record stored in our database automatically six months after your enquiry was received. Beyond that, the data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed); this applies in particular to the email in our mailbox that your enquiry triggered. Mandatory statutory provisions – in particular retention periods – remain unaffected.

Enquiries by email or phone

If you contact us by email or phone, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested.

The data you send to us via contact enquiries remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies.

Appointment booking

Via our appointment page you can request a video call, a phone call or a site visit. In doing so, we process: name, email address, the desired time and type of appointment and – depending on the type of appointment – your phone number (for a phone call) or the property address (for a site visit) as well as your request as free text. This data is stored in our database.

Processing is carried out to implement pre-contractual measures at your request (Art. 6(1)(b) GDPR). Without this information we cannot hold the appointment.

Transfer to Google: We use Google Calendar to manage appointments. When displaying available times, we already query Google as to which periods are occupied in our calendar; no data of yours is transmitted in this process. As soon as we confirm your request, a calendar entry is created containing your name, your email address, the type of appointment and – if provided – phone number, property address and your request. For video calls, Google also generates a Meet link. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework. Details: policies.google.com/privacy.

For every request you receive a confirmation by email with a link through which you can cancel the appointment yourself at any time. If you cancel or we cancel, the calendar entry is removed again. We delete appointment requests as soon as they are no longer required for initiating or handling the matter, at the latest after statutory retention periods have expired.

One-to-one guidance “Kein Groschengrab”

“Kein Groschengrab” is a 12-week one-to-one guidance for private owners of older buildings; it is provided in German. You do not book it via the website. It starts with a free initial call by video or phone, which you request via our appointment page (see “Appointment booking”); if you select the guidance as the occasion there, we note this with your appointment request. During and after the initial call we check whether the guidance fits your project (suitability check). If it does, you receive an offer from us.

Which data: your contact details (name, address, email address, phone number) and the address of the building; the information you give us in the initial call and the suitability check (for example about the building, the status of the renovation, existing recommendations, cost estimates or quotes, your budget and the decision you are facing); the documents you send us (for example quotes, cost estimates, plans and photos); our notes on the calls; the working documents we prepare for you; and the offer, contract, invoices and payments. Your documents may also contain information about third parties, such as names and contact details of tradespeople, planners or co-owners; we use it only for the guidance.

Purpose and legal basis: we process this data to initiate and perform the contract for the guidance: to check whether the guidance fits, to make you an offer and to provide the guidance. The legal basis is Art. 6(1)(b) GDPR; for invoices and payment data also Art. 6(1)(c) GDPR (retention obligations under commercial and tax law). We process information about third parties contained in your documents on the basis of our legitimate interest in advising you on the basis of your complete documents (Art. 6(1)(f) GDPR).

Calls by video or phone: we hold the calls by video via Google Meet or by phone; they are not recorded. The provider of Google Meet is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You do not need a Google account: without an account you ask to be admitted via the link and enter a name. During a video call Google processes the technical connection data (such as IP address, device and browser, time and duration of participation) as well as video and audio while your camera and microphone are switched on; if you use your own Google account, Google’s terms apply in addition. A transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework. Details: policies.google.com/privacy. The legal basis is Art. 6(1)(b) GDPR.

On-site building survey: at the start of the guidance we inspect the building on site. In doing so we take notes and photos of the building, for example of building components, damage and the building services. We use them exclusively for the guidance and do not publish them without your consent. The legal basis is Art. 6(1)(b) GDPR.

Exchange of documents via a cloud folder: we exchange documents and working drafts via a protected cloud folder that we set up for you. For this we use a cloud storage service, which we will name at the start of the guidance. The service stores the files on our behalf on the basis of a data processing agreement (Art. 28 GDPR); only you and we have access to your folder. The legal basis is Art. 6(1)(b) GDPR.

No disclosure to contractors: we do not pass on your documents or our assessments to contractors, planners, manufacturers or other third parties unless you expressly instruct us to do so.

Storage period: if no contract is concluded, we delete the information from the initial call and the suitability check as soon as it is no longer needed for initiating the contract. After the guidance has ended, we delete your documents in the cloud folder, the notes and photos from the on-site survey and our working drafts as soon as they are no longer needed for handling the guidance and documenting it, at the latest after statutory retention periods have expired. We keep the offer, contract, invoices and payment data for as long as required by retention obligations under commercial and tax law, and delete them afterwards.

Question channel via WhatsApp

For short questions between the calls of the “Kein Groschengrab” guidance we offer a question channel via WhatsApp. Using it is voluntary: if you do not want to use WhatsApp, simply send us an email instead; this has no disadvantages for you. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, a company of the Meta group.

Which data: your phone number, your profile name, the content of the messages and the metadata of the communication (such as who writes to whom and when, plus device and connection data). The content of the messages is end-to-end encrypted. WhatsApp processes the metadata under its own responsibility, also for its own purposes; we have no influence on this.

Transfer to the USA: data may be transferred to the USA, in particular to Meta Platforms, Inc., which is certified under the EU-US Data Privacy Framework; in addition, according to its own statements, WhatsApp bases the transfer on standard contractual clauses. Details can be found in the WhatsApp privacy policy.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract for the guidance), insofar as you choose this channel yourself.

No documents, no sensitive data: the question channel is intended for short questions. We do not exchange documents via WhatsApp but via the cloud folder. Please do not send sensitive data via WhatsApp either, such as bank details, ID data or health information.

Storage period: we delete the chats on our devices after the guidance has ended, unless a statutory retention obligation applies. We cannot delete what is stored on your own device and at WhatsApp.

Maintaining existing contacts (follow-up)

If you are already in contact with us – because you asked us for information, because we have been writing or speaking to each other, because you are a customer, because you have expressly allowed us to call you, or because you requested a free guide and confirmed the Baupost newsletter –, we keep an internal list so that we reliably send you the information we promised and follow up at reasonable intervals. The list is only accessible in the administration area of our course platform. We do not add anyone without such an occasion.

Which data: your name and, depending on how we are in contact, your email address, the address of your LinkedIn profile and – only if you gave it to us yourself, for example with a call-back request or in the contact form – your phone number. In addition, we record the occasion of the contact, the channel (e.g. LinkedIn, email or WhatsApp), which link (for example to a guide, a course or appointment booking) we sent you and when, the form of address, the status (e.g. “reply received” or “not interested”), the date of the next follow-up and, where applicable, a short note. We do not store the text of our messages in this list. From a contact form enquiry we only take your name, email address and, where given, your phone number; your message itself remains stored with the contact form and is deleted there after six months as described above.

Source of the data: the information comes from you – from our exchange, from your own request for a free guide with confirmation of the Baupost newsletter or your call-back request made with it (section 7), from the contact form or from an appointment booking (both above in this section) – or, if we are in contact via LinkedIn, from your publicly accessible LinkedIn profile (name and profile address). If we did not receive your data through a form on this website, our first message to you refers you to this privacy policy.

How the messages reach you: messages from this list are written and sent by Thomas Tergan personally – by email from his own mailbox (section 8), via LinkedIn, via WhatsApp or by phone, depending on the channel you use with us. Only emails to addresses whose Baupost newsletter subscription has been confirmed are sent automatically (section 7, “Personal emails about your request”). If we write to you via LinkedIn or WhatsApp, these services also process the content of the message: LinkedIn (LinkedIn Ireland Unlimited Company, Dublin, part of the Microsoft group) and WhatsApp (WhatsApp Ireland Limited, Dublin, part of the Meta group). Both also transfer data to the USA; according to their own information, they base such transfers on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. Details can be found in the privacy notices of LinkedIn and WhatsApp. We only use these channels if we are already in contact with you through them.

No evaluation of individual clicks: the links in these messages carry a code that only identifies the channel and the calendar week of sending (e.g. “li-kw39-26” for LinkedIn in calendar week 39 of 2026) – everyone who receives a link through the same channel in the same week carries the same code. Visits via such a code are only added as a total to the daily counters (section 1). These totals are only evaluated once at least three people have received a link with that code in that week and the week is over, and even then only in aggregate. We do not attribute a mere click on a link to you. If you submit a form via such a link (for example a guide request or an appointment request) or buy something, the origin is recorded – as with any other visit; for codes from our personal messages we shorten this information to “follow-up” within one hour at the latest, without channel and week. Until then, the full code also appears in the notification of a contact enquiry in our mailbox and, in the case of a purchase, is transmitted to our payment provider Stripe as the origin.

Matching with your own actions: if your email address is entered in the list, we match it within our own database against actions you have taken yourself: whether you requested and confirmed a guide or confirmed the newsletter, whether you requested an appointment, whether you paid for a course or a paid consultation, whether you wrote to us via the contact form and whether you still receive the Baupost newsletter. This prevents us from writing to you in addition to automated emails, following up before an agreed appointment, sending reminders after a purchase or writing to you personally after you have unsubscribed from the Baupost newsletter. We take into account actions from our first message to you on this matter or from your enquiry, call-back request or appointment (at most 90 days before you were added to the list). Whether you have already bought from us is also checked retrospectively, so that we do not approach customers with an offer they already have. Matching is based solely on the email address; without an address, no matching takes place.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in maintaining existing contacts, sending promised information and not writing too often or twice. If we call you because you asked us to or expressly allowed us to, this is based on your consent (Art. 6(1)(a) GDPR, Section 7(2) No. 1 UWG; see “Phone number (optional)” in section 7). If the contact relates to a contract or its initiation, Art. 6(1)(b) GDPR also applies. We only send promotional messages to existing customers by email to the address you provided when buying, only about our own similar services, and with a note in every message that you can object at any time without incurring any costs other than the transmission costs at the basic rates (Section 7(3) UWG). For personal messages to people who receive the Baupost newsletter, the following paragraph applies.

If you receive the Baupost newsletter: if you requested a free guide and confirmed the Baupost newsletter (section 7), we add you to this list automatically – with your email address, the first name you optionally provided, the guide you requested and the time of confirmation, i.e. with data from your own request. About 14 days after the confirmation, we ask you in a personal email whether the guide was helpful. After that, you receive a short personal email to this address about every three months for as long as you receive the Baupost newsletter – even if we are otherwise in contact via LinkedIn or WhatsApp; the same applies if we are already in contact for another reason and the follow-ups on it have ended. Thomas Tergan writes these emails himself, or they are sent automatically if he has not already written to you (section 7, “Personal emails about your request”). If you have bought from us, we no longer send you such personal messages; the entry then remains without further follow-ups. The legal basis is your consent to the Baupost newsletter “with tips and suitable offers on courses and consultancy” (Art. 6(1)(a) GDPR, Section 7(2) No. 2 UWG). We keep this entry for as long as your consent exists. If you unsubscribe from the Baupost newsletter – via the unsubscribe link in every issue or with a short message –, we delete it automatically at the next hourly check; if it is also based on an occasion of its own (for example an enquiry, a conversation or a purchase), we no longer send you any message based on the Baupost newsletter, close the entry – once any occasion still open has been dealt with – and delete it after the periods stated below. If you want to keep reading the Baupost newsletter but no longer receive personal messages, a short reply is sufficient.

How often we follow up: after the first message we follow up at most twice on any one occasion. If there is no response, we close the entry seven days after the last message and do not write to you about it again – unless you receive the Baupost newsletter: then the entry remains, and we only get in touch briefly by email about every three months (see “If you receive the Baupost newsletter”). If you say you are not interested, we close it immediately in any case; any permission to call you also ends, and we will not add you again for personal follow-ups even if you later request another guide. So that this still applies after the entry has been deleted, we keep only an irreversibly encrypted check value (hash) of your email address for three years – without your name and without the address in plain text (Art. 6(1)(f) GDPR; our legitimate interest is to respect your wish reliably).

Daily overview: on working days, Thomas Tergan receives an overview at our own mailbox info@sustainabim.com showing with whom a step is due that day (name, next step, prepared text and – for an enquiry – your enquiry for reference), together with the number of emails sent automatically since the previous working day (the number only, without names). This email is kept in our mailbox at Hostinger (section 8), is not sent to anyone else and is deleted once processed, at the latest after 14 days.

Proof of consent to phone calls: if you have allowed us to call you, we record when and how you consented (for a form: time, wording and an encrypted IP trace; otherwise date, form and a short note on the occasion), together with your name, phone number and, where applicable, email address. As required by Section 7a UWG, we keep this proof for five years from your consent and after each use – even if your entry in the list is deleted earlier or you withdraw your consent (Art. 6(1)(c) GDPR, Art. 17(3)(b) GDPR). It is then deleted automatically.

Storage period: we automatically delete closed entries – for example after “not interested”, without a response or after a purchase – six months after closing. Open entries with no further activity are deleted automatically twelve months after the last activity. If your entry remains because you receive the Baupost newsletter – with a short email about every three months or, if you have bought from us, without further personal follow-ups –, these two periods do not apply: we keep it for as long as your consent exists and delete or close it when you unsubscribe, as described above. For proof of consent to phone calls, the note after “not interested”, the blocking note and the daily overview, see the respective paragraphs.

Objection and erasure: you can object to this processing at any time (Art. 21 GDPR) and request erasure (Art. 17 GDPR). A short reply to our message or an informal email to info@sustainabim.com is sufficient. If you object, we delete your entry including its history immediately, end any permission to call you and – since an objection to direct marketing also covers these – unsubscribe you from the newsletter and the automated email series. So that we do not accidentally add you again afterwards, we keep a blocking note: an irreversibly encrypted check value (hash) of your email address, LinkedIn address or phone number, without your name and without the data in plain text, for three years (Art. 17(3)(b) and (e), Art. 21(3) GDPR). If you contact us again yourself later, we will answer that new enquiry. To ensure that a deleted call-back request, contact enquiry or appointment is not automatically added again, we also keep only its internal number for up to 60 days – without your name, address or any other information about you.

Withdrawal function (“Withdraw from contract”)

On the page “Withdraw from contract” you can withdraw from a contract concluded with us online without logging in. In doing so, we process: your name, your email address, the contract you are withdrawing from and – if provided – order or booking number, order date and your additional information, as well as the date and time of receipt and the language of the page. This data is stored in our database. You immediately receive a confirmation of receipt at the email address you provided; at the same time a notification is sent to our mailbox info@sustainabim.com.

The purpose is to receive and process your withdrawal – including any refund – and to be able to prove when which notice was received. The legal basis is Art. 6(1)(c) GDPR: we are legally obliged to provide such a withdrawal function, to confirm receipt of your notice without undue delay and to process the withdrawal. Insofar as we retain the data beyond this in order to be able to prove receipt and processing of your withdrawal, the additional legal basis is our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).

To protect against misuse, the form contains a field that is invisible to you and a signed timestamp. We also limit the number of notices per sender; for this purpose your IP address is not stored in plain text, but only kept as a non-reversible check value (an SHA-256 value generated with a secret key). This check value is no longer used after one hour and is then deleted automatically. The legal basis is our legitimate interest in a functioning form that is protected against automated misuse (Art. 6(1)(f) GDPR). No cookies are set on this page.

We store the data for as long as we need to prove receipt and processing of your withdrawal: as a rule until the regular limitation period of three years has expired, calculated from the end of the year in which the withdrawal was received. If the notice forms part of records we must retain under commercial or tax law (for example as a voucher for a refund), we keep it until the end of the applicable statutory retention period. It is then deleted.

Termination function (“Cancel contracts here”, Section 312k BGB)

On the page “Cancel contracts here” you can terminate an ongoing contract with us – for example an instalment plan for a video course or the one-to-one guidance “Kein Groschengrab” – without logging in (termination button under Section 312k of the German Civil Code, BGB). In doing so, we process: the type of termination (ordinary or for good cause), the contract you are terminating, your first and last name, the email address of your booking, the date on which you want the contract to end and – if provided – a different email address for the confirmation, your booking or invoice number and the reason for the termination or your additional information, as well as the date and time of receipt and the language of the page. This data is stored in our database with our hosting provider (section 2); the emails are sent as described under “Sending emails” in section 8. You immediately receive a confirmation of receipt at the email address you provided and can download your notice as a text file for 30 days via the link on the confirmation page and in the confirmation email; at the same time a notification is sent to our mailbox info@sustainabim.com.

The purpose is to receive your notice of termination, to confirm its receipt with date and time, to examine whether and when it takes effect, to process it and to be able to prove when which notice was received. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 312k BGB: we are legally obliged to provide such a termination button and to confirm to you without undue delay, in text form, the content, date and time of receipt of your notice and the date of termination you stated; processing the termination is based on Art. 6(1)(b) GDPR. Insofar as we retain the data beyond this in order to be able to prove receipt and processing of your notice, the additional legal basis is our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).

To protect against misuse, the form contains a field that is invisible to you and a signed timestamp. We also limit the number of notices per sender; for this purpose your IP address is not stored in plain text, but only kept as a non-reversible check value (an SHA-256 value generated with a secret key). This check value is no longer used after one hour and is then deleted automatically. The legal basis is our legitimate interest in a functioning form that is protected against automated misuse (Art. 6(1)(f) GDPR). No cookies are set on this page.

We store the data for as long as we need to prove receipt and processing of your notice: as a rule until the regular limitation period of three years has expired, calculated from the end of the year in which the contract ended or – if the termination was not effective – in which the notice was received. If the notice forms part of records we must retain under commercial or tax law, we keep it until the end of the applicable statutory retention period. It is then deleted.

5. Course area and customer account

Our video courses are provided via a separate members’ area at kurse.sustainabim.com. The following sections apply to this area.

Account and login

An account is required to access purchased courses. For this purpose, we store your email address, a first name of your choice (only if you write in the community), the time the account was created and the time of your last login.

Login takes place without a password: you receive a six-digit one-time code by email. This code is only stored by us as a non-reversible check value (SHA-256), expires after 30 minutes and is invalidated after use. Failed attempts and the time of the request are logged to prevent brute-force guessing.

The legal basis is Art. 6(1)(b) GDPR (performance of the purchase contract for the course).

Payment processing via Stripe

We process purchases via the payment service provider Stripe. The provider for customers within the EEA is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When you make a purchase, you are redirected to a payment page operated by Stripe. You enter your payment data – in particular card numbers – exclusively there; it never reaches our servers. Stripe processes, under its own responsibility, among other things your payment data, your email address, the invoice amount and technical features such as IP address and device data to prevent fraud.

For each purchase we receive back from Stripe: the payment ID, your email address, the purchased course, the amount, the currency and the payment status. We store this information to assign your course access and to fulfil our retention obligations under commercial and tax law.

The legal basis is Art. 6(1)(b) GDPR. A transfer to the USA cannot be ruled out; Stripe is certified under the EU-US Data Privacy Framework, see dataprivacyframework.gov. Further information: stripe.com/privacy.

Video delivery via Bunny Stream

The course videos are delivered via Bunny Stream, a service of BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia.

When you play a video, the player is loaded from the provider’s servers. Bunny receives your IP address, technical information about your browser and device and information about the video accessed. Access takes place via time-limited, signed addresses, so videos cannot be accessed outside the members’ area. We ourselves do not receive any personal analyses from Bunny.

The legal basis is Art. 6(1)(b) GDPR, as providing the videos is an essential part of the contract. The provider is based in the EU; according to the provider, no transfer to third countries takes place. Further information: bunny.net/privacy.

Learning progress

If you mark a lesson as completed, we store this against your account so that you can continue from there on your next visit. Your learning behaviour is not analysed; in particular, playback times or drop-out rates are not measured. The legal basis is Art. 6(1)(b) GDPR.

6. Community

In the course area we operate a discussion area in which logged-in users can open and reply to topics.

What others see: For each post, only a first name, the time and the content are displayed. Your email address is never visible to other participants. You can also publish any post anonymously; the note “Anonymous” then appears instead of your first name.

What we see: Even with anonymous publication, the assignment of the post to your account remains stored in our database. This is necessary so that we can meet our responsibility for the content of our offer, remove unlawful posts and prevent misuse. “Anonymous” therefore means: anonymous towards other participants, not towards us as the operator. The legal basis for this is our legitimate interest in a lawful and moderated offer (Art. 6(1)(f) GDPR).

Access: The discussion area is currently only accessible to logged-in users; the areas for individual courses are only open to the respective course participants. These pages are blocked for search engines.

Your posts: You can delete your own posts yourself at any time. We remove posts that violate applicable law or our code of conduct. Please do not publish any personal data of third parties there, in particular no addresses of other people’s properties. The legal basis for publishing your posts is Art. 6(1)(b) GDPR in conjunction with your use of the offer.

Posts remain stored until you delete them, your account is deleted or we remove them. We apply a technical limit on the number of posts per hour to prevent mass publication.

7. Newsletter and free resources

On our website you can subscribe to our newsletter (“Baupost”, in German) and request free resources (checklists, guides). Both use the same procedure.

Registration by confirmation (double opt-in)

After signing up, you first receive an email with a confirmation link. Only when you click it do we add you to the mailing list and release a requested resource. Without this confirmation we send no advertising and deliver no file. This ensures that nobody can be registered with someone else’s address.

We store: your email address, the first name you voluntarily provide, the origin of the registration (which form or which resource), the time of registration and confirmation, and in each case your IP address only as a non-reversible hash value. The hash value serves solely as proof of consent; your IP address cannot be derived from it.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 7(2) No. 2 UWG (German Act against Unfair Competition). We store the proof data on the basis of our legitimate interest in documenting consent given (Art. 6(1)(f) GDPR).

To protect against misuse – for example strangers entering other people’s addresses – the forms contain a field that is invisible to you and a signed timestamp (no cookie), and we limit the number of sign-ups per sender, per address and in total. For the limit per sender, your IP address is not stored in plain text, but only kept as a non-reversible check value (an SHA-256 value generated with a secret key) for a maximum of one hour; for the other limits we note for a maximum of 25 hours when an email was sent for which sign-up. The legal basis is our legitimate interest in forms that are protected against automated misuse (Art. 6(1)(f) GDPR).

Unsubscribing

You can withdraw your consent at any time with effect for the future. Every email contains an unsubscribe link for this purpose, which works with one click — without logging in and without further questions. Alternatively, an informal message to info@sustainabim.com is sufficient. After unsubscribing we send nothing more; your address remains stored in a blocked state so that we do not accidentally write to you again, and is deleted after statutory retention obligations have expired.

Performance measurement

Our newsletters contain a so-called tracking pixel — a small image file that is retrieved from our server when the email is opened. In addition, links contained in the email lead via a redirect on our own server. This allows us to see whether an email was opened and which link was clicked. We link this information to your registration in order to assess which topics are read. Unsubscribe, legal notice and privacy links are excluded from counting.

The legal basis is the consent you give when registering (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via the unsubscribe link; measurement then also ends. No data is transferred to third parties, and no profile is created that goes beyond opening and clicking.

Free resources

If you request a resource, we additionally store which file you requested, when access was released and whether the file was downloaded. The file is provided via a personal, cryptographically signed link. We use this information to enable the download and to see which resources are in demand. The legal basis is Art. 6(1)(b) GDPR for providing the requested file and your consent for receiving the newsletter.

Emails are sent via the mailbox of our hosting provider Hostinger. No external newsletter service provider is involved; your address does not leave our systems.

Phone number (optional)

When requesting a resource, you can optionally provide a phone number. We only store it if you additionally give explicit permission for us to call you to discuss your project. Without this permission the number is not stored. Together with the number we record the time of your permission, the wording you agreed to and your IP address as a non-reversible hash value. The number is not passed on to third parties.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) No. 1 UWG). You can withdraw it at any time with effect for the future — informally by email to info@sustainabim.com or during the call itself. Unsubscribing from the newsletter does not automatically end the permission to call; if you wish to end both, one sentence in your message is enough. As required by Section 7a UWG, we keep proof of your consent for five years from when it was given and after each use.

Personal emails about your request

On the basis of your consent to the Baupost newsletter, we also send you individual personal emails at a suitable time – for example about a day after a call-back request if we have not reached you by then, after an unsuccessful call attempt, about two weeks after you requested a guide, after a conversation or a few days after our reply to your enquiry; in addition, a note pointing you to a guide, a course or an initial consultation together with at most two follow-ups on it, and after that a short message about every three months. Our system sends them automatically if Thomas Tergan has not already written to you himself – only Monday to Friday (not on public holidays) between 8 am and 6 pm, at most one such email within 20 hours, and only as long as your Baupost subscription is confirmed and not cancelled; we check this at the moment of sending. Your reply goes directly to Thomas Tergan. For this we use the data from your request: your email address, the first name you optionally provided or that is noted in our contact list, the guide you requested, your call-back request and, where applicable, the date of your appointment (see “Maintaining existing contacts” in section 4). There is no evaluation per person: these emails contain no tracking pixel and no redirect via our server; their links only carry the code of the week of sending. We record the sending in the history of your entry and in an internal log, which we delete after 60 days. You can unsubscribe at any time via the link in each of these emails; this also ends these messages. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) No. 2 UWG).

8. Integrated services

Map display (OpenStreetMap)

On our contact page we integrate a map from OpenStreetMap. The provider is the OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

The map is not loaded automatically. At first you only see a placeholder; only when you actively click on it is a connection to OpenStreetMap established. Your IP address is transmitted to the provider in the process. Without your click, no transmission whatsoever takes place.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give by clicking on the placeholder and which you can withdraw at any time with effect for the future by reloading the page and not activating the map again. An adequacy decision of the EU Commission exists for the United Kingdom. Further information: osmfoundation.org.

Fonts

This website uses the fonts “Geist” and “Public Sans”. Both are delivered exclusively from our own server. There is no connection to Google Fonts or other external font providers; your IP address is not transmitted to any third party for this purpose.

Sending emails

All emails that we send in connection with the contact form, appointment booking and the course area are sent via the mailbox of our hosting provider Hostinger. The newsletter and the free resources (section 7) are also sent via this mailbox. Your address is not passed on to external newsletter or marketing services.

9. Status of this policy

This privacy policy was last adapted to the actual scope of our offer on 5 October 2026. If the services we use change, we will update it accordingly.