Privacy notice

The controller within the meaning of the GDPR for the processing described here is Beyond Engineering Works GmbH, Hadikgasse 64, 1140 Vienna, Austria; email hallo@duplex.immo; phone +43 699 101 98 200. "DUPLEX" is the brand under which the company offers its services.

When you visit our website, connection data arises to the extent technically required (for example date and time of the request, the content requested, browser and device data, the technical IP address seen by the serving infrastructure, and error logs). This is processed for delivery, security and fault correction on the basis of our legitimate interest (Art. 6(1)(f) GDPR), unless another legal basis applies.

When you enter the address of the property, we process the address given, the search and routing parameters required, the calculated distance and, where applicable, zone data, in order to produce the price calculation you requested. The address search and the distance calculation run on our servers using Google services; what is sent are the address and location details required for the search and the calculation, not your device’s IP address. Your browser does not connect to Google directly for this function. It is separate from the consent-based advertising measurement with Google Ads; see section 7 for details. The legal basis is Art. 6(1)(b) GDPR where a contract is being prepared, otherwise Art. 6(1)(f) GDPR for a price enquiry you have asked for.

We process name, email, phone number, company and VAT number where given, property address, gross floor area, selected data products, pricing parameters, appointment, notes, booking number, booking and declaration logs and email correspondence, in order to handle enquiries, prepare and perform contracts and evidence our claims (Art. 6(1)(b) and (f) GDPR). Information and accounting data we are required by law to document is processed on the basis of Art. 6(1)(c) GDPR. The phone number you provide is used for the agreed coordination of the appointment and for the contactability required by law.

During an agreed building capture, faces, number plates, markings, furnishings or other personal information relating to third parties may be recorded, depending on access and the state of the property. We reduce such capture on site where possible. Before delivery we remove personal image content from the results. Pixelation does not guarantee full anonymisation of all data.

The internal original recordings are not redacted and may contain personal content. Their internal storage is subject to the GDPR as well; how long we keep them is set out in section 9.

Where we act for a business customer on its documented instructions, DUPLEX processes the recordings concerned as a processor and refers to that controller for the legal basis, the full information of data subjects and their rights; our own statutory obligations remain unaffected. Where DUPLEX is itself the controller, we establish the applicable legal basis, in particular a sound balancing of interests under Art. 6(1)(f) GDPR or the consent required; the requirements of Art. 9 GDPR apply separately to special categories of data.

We use the following service providers. For each one we name the purpose, where processing takes place and the role under the General Data Protection Regulation. No statistics or analytics software is in use at present; should that change, this list will be extended beforehand.

Vercel Inc. (USA) — web hosting, delivery of the website, protection against automated access and the access logs this produces. Execution takes place in Frankfurt am Main. Processor.

Cloudflare, Inc. — name servers for our domains, and storage and delivery of result data via data.duplex.immo. Storage region Western Europe. Processor.

Google Ireland Limited (Google Maps Platform) — address suggestions and travel distance. The request is made by our server: what is sent is the address you typed, not your device's IP address. Processor.

Resend (Ireland, region eu-west-1) — delivery of the confirmation, acceptance, invoice and reminder e-mails. Processor.

Stripe Payments Europe, Ltd. (Ireland) — card payment and invoicing. Stripe is an independent controller for the payment itself and a processor for the invoice data.

Microsoft Ireland Operations Limited — the hallo@duplex.immo mailbox and the calendar your appointment is written into. Processor.

Austro Control GmbH (Austria) — checking the airspace and geo-zone situation at your property. We send the coordinates of the property.

European Commission, VAT Information Exchange System (VIES) — confirming a VAT identification number you have given for a property outside Austria. Only the VAT number is sent.

Google Ireland Limited (Google Ads) — measuring whether an advert led to an enquiry or a booking. Loaded only after your consent; details in section 7. Processor or independent controller depending on the function.

Matterport, Inc. (USA) — hosting and delivery of the 360° tour. The view is loaded only on your click. Independently responsible for its own platform use.

SuperSplat — hosting and delivery of the Gaussian splat example, likewise only on a click.

Upstash, Inc. (Frankfurt am Main region) — short-term store for booking operations, protection of the forms against abuse, and the record of your cookie decision. Processor.

Authorised specialist partners, in particular a chartered surveying engineer, receive only the customer and property data required for the part of the work agreed with them. Joint controllership or processing is agreed only where the actual arrangement calls for it.

Without your consent this website runs only technically necessary functions: the session, your language setting, protection of the forms against abuse, and storing your cookie decision itself. These data arise from operating the website and are processed solely by the technical service providers listed in section 6 that act for us — in particular Vercel for delivery and Upstash for form protection and the record of your cookie decision. They are indispensable for operating the site and therefore cannot be switched off (section 165(3) Austrian Telecommunications Act 2021).

We do not use any statistics or analytics software. There is no reach tracking, no user profile and no service that evaluates your behaviour across pages. Should that change, this section will be extended beforehand and consent obtained anew.

Advertising: with your consent we load Google Ads in order to measure whether an advert led to an enquiry or a booking. Only with your consent is a Google script loaded and a cookie set; before that nothing is fetched from Google (Google Consent Mode, basic configuration). Google uses cookies or similar technologies for this and receives data in the process, including your IP address, the page you visited and whether a booking was made. Our contracting party in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; depending on the function Google acts as processor or as an independent controller. Data may be transferred to the USA in the process. By Google's own account it bases this transfer on the EU-US Data Privacy Framework, to which Google LLC has self-certified, and additionally on the European Commission's standard contractual clauses. On our side the legal basis is your consent under Art 6(1)(a) GDPR in conjunction with section 165(3) of the Austrian Telecommunications Act 2021.

Third-party views: the 360° tour is hosted by Matterport, Inc. (USA), the Gaussian splat example by SuperSplat. Neither loads automatically. Only when you expressly start the tour or the model does your browser open a connection to that platform; nothing is transmitted there before the click. Matterport then receives your IP address and your device's technical details — according to the provider the truncated IP address, browser and device type, screen size, time zone, language and graphics characteristics — and analyses use of the tour to develop its own product. According to Matterport no cookies are set for visitors who are not signed in; the tour stores settings such as the unit of measurement in your browser's local storage. The legal basis for this connection is our legitimate interest in presenting a sample property under Art. 6(1)(f) GDPR, together with your express request to open the tour.

Your consent is voluntary. You can withdraw it at any time with effect for the future, under “Cookie settings” in the footer of every page; declining has no disadvantage for using the site or for making a booking. To demonstrate your decision we store a random reference number, the time, the version of the consent text, the categories chosen and the language — expressly without IP address, browser identifier or referrer (Art 7(1) GDPR). This record is held at Upstash, Inc. (Frankfurt am Main region) and is deleted automatically after three years; there is no statutory period for it, the span covers the general limitation period. If the consent text changes in substance, we ask again.

We process invoices and payment reconciliation on the basis of the contract (Art. 6(1)(b) GDPR) and of statutory bookkeeping and tax obligations (Art. 6(1)(c) GDPR).

Consumers pay the total price by card when placing the order. The payment is handled by Stripe; you enter your card details directly with Stripe and DUPLEX does not receive them. We receive from Stripe the payment reference, the amount, the status and the details needed to match the payment. Stripe processes the payment data as a controller in its own right under its own privacy notice.

Business customers receive an invoice with a payment term; for that we process the invoice and payment data arising from account reconciliation. Invoices are created and sent through Stripe; for that, Stripe processes your name, your billing address, any VAT number given and the invoice lines, and keeps the invoice for payment reconciliation and reminders.

We store personal source recordings for handling the order and any agreed corrections for up to six months from the final delivery. They are deleted afterwards. Individual components required to establish, exercise or defend specific legal claims are kept until the matter concerned is closed.

We keep the redacted result files of your order in live operation for the same six months and then move them into an archive that nobody touches in day-to-day work; it serves re-orders from the same data set. Later retrieval is not promised. You can ask us to delete your project files at any time, unless a statutory retention obligation stands in the way. Please save the delivered results within those six months. Ongoing hosting additionally follows its agreed term, export and deletion periods.

Invoices and tax-relevant records are generally stored for seven years from the end of the relevant calendar year under section 132 of the Austrian Federal Fiscal Code, and longer where proceedings are pending. Evidence relating to bookings and the exercise of rights is kept only within the justified limitation and evidence periods. Technical backup copies are subject to a separate, limited rotation and restore regime: backup copies are kept on a rolling 30-day basis and are then overwritten automatically. For processing on behalf of a controller, documented and lawful deletion instructions and the agreed data processing agreement take precedence.

We do not publish a customer’s recordings, models or addresses as a reference automatically. Publication requires a separate, specific release covering the intended form, duration and reach, and respect for third-party image, personality, property and data protection rights. Where processing is based on consent, that consent can be withdrawn with effect for the future under the statutory rules.

Subject to the statutory conditions you may request access, rectification, erasure, restriction, portability or object to processing, and withdraw consent you have given with effect for the future. Please contact hallo@duplex.immo. You may lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, https://www.dsb.gv.at/. Where we act purely as a processor, we forward such requests to the responsible controller in accordance with our data processing agreement.

The calculator applies generally defined pricing and distance rules. No decision based solely on automated processing with the significant effects referred to in Art. 22 GDPR is made.