I. General Information

“Personal data” means any information relating to an identified or identifiable natural person. This may include personal as well as professional or economic information, characteristics, knowledge, or physiological features. Personal data includes details such as name, date of birth, address, and telephone number.

Sensitive data:

The processing of sensitive data is permissible only where the data subject has given consent for one or more specific purposes. Sensitive data under Article 9 GDPR includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; and biometric data for the purpose of uniquely identifying a natural person.

Providing services in the area of property sale, purchase, and rental frequently requires the processing of sensitive data. In particular, information about family life may be relevant (for example, when searching for property suitable for you and your family, from which sexual orientation may be inferred).

Rarely, but possibly, data on political opinions or religious beliefs may also be relevant (for example, when we consider the proximity of churches or religious organisations during a property search).

In the course of processing your enquiries, it may be necessary to disclose your data to third parties (for example, lawyers / tax advisors / financial institutions).

Any consent given by you for this purpose may be withdrawn at any time.

II. Declarations of Consent

1. I hereby consent to my sensitive data being collected and processed for the purpose of performing the contract.
2. I also consent to the processed data being disclosed to third parties within the scope of this contract, in particular to lawyers/tax advisors/financial institutions.
3. I am aware that I may withdraw this consent at any time.
4. I have read and acknowledged the data protection information sheet.

Data Protection Information Sheet (Art. 13 et seq. GDPR)

Data protection is of great importance to us. We assure you that we process your personal data in accordance with the principle of good faith and only for the purposes set out below. We also confirm that we have implemented appropriate technical and organisational measures to protect your data and to comply with our obligations under the GDPR and the 2018 Data Protection Adaptation Act. In accordance with Articles 13 et seq. GDPR, we would also like to provide you with the following information regarding the processing of your personal data and your related rights.

Controller: VigoImmobilien GmbH, Bösendorferstrasse 1/1/18-19, 1010 Vienna, Austria. E-mail: [email protected]. Tel: +43 664 99 877 599.

Purpose: Provision of services in the area of property sale, purchase, and rental, and related activities.

Legal basis: Vermittlungsauftrag/Vollmacht (brokerage mandate/power of attorney); Einwilligungserklärungen (declarations of consent); gesetzliche Grundlagen (statutory legal grounds).

Categories: Contact data/personal data (name, address, e-mail address, date of birth, telephone number); legitimation data (identity document data); documentation data (official records, expert opinions, court decisions).

Retention period: For as long as we are in a contractual relationship with you, all data collected by us will be retained subject to all applicable technical and organisational protective measures. Should the contractual relationship with you end, we are obliged to minimise the data while observing our statutory retention and documentation obligations as well as statutory limitation periods.

Categories of recipients: Our own enterprise: real estate agent, accounting, client manager; order processors, IT specialists. Financial institutions: Bausparkasse; other service providers engaged by the controller, such as tax advisors or, where necessary, lawyers, public authorities, etc.; experts and claims settlement companies.

III. Automated Communication Using Artificial Intelligence (calls, e-mail, SMS, messaging apps)

This section supplements the information above and concerns instances of data processing related to the use of artificial intelligence (AI) systems for communicating with you and processing your enquiry.

What we do

If you have submitted an enquiry on our website or through an advertising form (for example, Meta Ads) and have given your explicit consent, we may use automated artificial intelligence systems to contact you by telephone, e-mail, SMS, WhatsApp, Telegram, Messenger, or other electronic communication channels that you yourself have indicated when submitting your enquiry. The purpose of such contact is to qualify your property enquiry: clarifying budget, preferred location, property type, timeframe, and other relevant parameters.

AI voice assistant

You may receive a call from an automated AI voice assistant operating under the brand “Vigo Immobilien” (VigoImmobilien GmbH). At the start of each call, the assistant informs you that you are speaking with an artificial intelligence rather than a human, and asks for your consent to record the conversation. If you do not consent, no recording is made and the call ends.

AI correspondence (e-mail, SMS, messaging apps)

An automated AI assistant may also respond to your messages, send e-mails, clarify information relating to your enquiry, ask further questions to help formulate the most relevant proposals, and suggest a possible time for a meeting or property viewing on behalf of VigoImmobilien GmbH. During e-mail correspondence or messaging, the AI always identifies itself as an automated assistant of VigoImmobilien at the start of the interaction. You may at any time request to continue communicating directly with a VigoImmobilien staff member.

Compliance with the EU AI Act

We use artificial intelligence systems in accordance with the requirements of Regulation (EU) 2024/1689 (AI Act). Our AI is used exclusively for initial communication, information gathering, and preparing proposals. We ensure appropriate human oversight of the use of artificial intelligence systems. Final decisions regarding the conclusion of contracts, property viewings, commercial proposals, or other legally significant actions are made exclusively by VigoImmobilien GmbH staff.

What data is processed

• your telephone number, e-mail and/or messaging app contact, name, and property search criteria (budget, location, property type, language of communication, desired purchase or rental timeframe, rental or purchase motivation);
• audio recording of the telephone call and text transcript, subject to your consent to recording;
• the content of correspondence with the AI assistant via e-mail or messaging apps;
• an automatically determined demand category A/B/C and other analytical parameters (budget, location, property type, motivation, language, estimated transaction timeframe, purchase or rental) — used exclusively for internal prioritisation of the enquiry; the decision on any proposal or appointment is always made by a human;
• confirmation of your consent (time, date, and the wording of the consent you saw).

We do not create a biometric voice profile and do not use your voice for identification purposes. The information obtained may be automatically transferred to the VigoImmobilien CRM system for further handling by our staff.

Legal basis

Processing is carried out on the basis of Art. 6(1)(a) GDPR (your consent), which simultaneously constitutes the basis for the call pursuant to § 174 TKG 2021 (Austrian Telecommunications Act) and for recording the conversation, as well as, where a contractual relationship arises between the parties, on the basis of Art. 6(1)(b) GDPR. No call or automated correspondence takes place without your consent.

AI service providers (processors)

We may use various AI service providers for text generation, speech synthesis, speech recognition, telephony, and communication automation. The list of providers may change without prior notice in line with the development of our technological solutions. As at the date of publication of this text, these providers include:

Provider	Region	Role
Vapi Labs, Inc.	USA	AI call orchestration
Telnyx LLC	USA (EU CDR region where possible)	Telephony carrier
Gladia	France / EU	Speech recognition (primary)
Deepgram, Inc.	USA	Speech recognition (fallback)
ElevenLabs, Inc.	USA	Assistant voice synthesis
Anthropic PBC (Claude)	USA	AI analysis of text/transcript and A/B/C category determination
Hetzner Online GmbH	Germany / EU	Hosting and data storage

Transfer of data outside the EU

Some providers process data in the USA. The transfer is based on the EU Standard Contractual Clauses (SCC), where necessary combined with EU-US Data Privacy Framework certification, and supplemented by a transfer impact assessment (TIA). A copy of the safeguards is available upon request.

Marketing communications

Where messages relate exclusively to the processing of your specific property enquiry, they are carried out within the scope of that enquiry. Separate promotional or informational messages about new properties or marketing offers are sent only where separate consent has been given, where such consent is required by law. We send such messages (by telephone, e-mail, SMS, or messaging apps) exclusively to persons who have themselves submitted an enquiry and given the relevant consent.

Retention period

• Audio recordings and transcripts of calls, as well as the content of AI correspondence: deleted no later than 30 days after the relevant interaction;
• the determined demand category (A/B/C) and other analytical parameters, as well as core contact data: retained for the general duration of the client enquiry (approximately 3 years from the date of last contact);
• confirmation of consent: retained for the period of active communication plus the statutory limitation period (approximately 7 years) — as evidence of the lawfulness of processing.

Withdrawal of consent

You may at any time opt out of further AI calls or messages by notifying us in any manner (for example, at [email protected] or by replying “STOP”) or by clicking the relevant opt-out link in an e-mail, where one is provided.

Absence of automated decision-making with legal effect

The AI qualification is used solely for internal preparation ahead of a conversation with a member of staff. The decision on whether to make a proposal or schedule an appointment is always made by a human. The AI does not make autonomous legally significant decisions and does not carry out fully automated decision-making in relation to clients. For example, the AI may propose possible dates and times for a property viewing, but final confirmation of any appointment is always carried out by a VigoImmobilien staff member. No automated decision within the meaning of Art. 22 GDPR, which would produce legal effects concerning you or similarly significantly affect you, takes place.

Consent text on the enquiry form

The following two separate consent checkboxes are used on the enquiry form (neither pre-checked):

☐  Mandatory: I consent to the processing of my enquiry and to being contacted about it (by telephone, e-mail, SMS, or other electronic communication channels) using automated artificial intelligence systems.

☐  Optional: I consent to receive information about new properties, promotions, and other offers from VigoImmobilien.

Data minimisation

We kindly ask that you do not share special categories of personal data (such as health data, political opinions, religion, etc.) with the AI assistant unless this is necessary for processing your enquiry. Should such data nevertheless be inadvertently shared, we will process it only to the extent necessary to fulfil your enquiry or as required by law.

Cookies and web analytics tools

Where AI communication is initiated through a form on our website, we may use the following for collecting initial enquiry data and analytics: Meta Pixel, Google Analytics, CRM integration tools, and lead-tracking tools. Detailed information on the cookies used and the option to manage your settings is available in the Cookie Settings section of our website.

IV. CRM and Client Data Management Systems

To organise our work with properties and client enquiries, we use specialised software.

JustImmo

A CRM system and property database (provider: B&G Consulting & Commerce GmbH, Mariahilferstraße 8/11, 1070 Vienna, Austria), which we use to manage property listings, client enquiries, and transaction support.

NetHunt CRM

A customer relationship management system (provider: NetHunt Inc., 651 N Broad St., Suite 206, Middletown, DE 19709, USA), which we use to process enquiries, maintain a history of client communication, and internally coordinate lead handling.

What data is processed

• contact data (name, telephone, e-mail);
• property enquiry information (budget, location, property type, enquiry status);
• communication history (manager notes, transaction stages).

Legal basis

Vermittlungsauftrag/Vollmacht (brokerage mandate), performance of contract, and legitimate interests in organising our own business activities (Art. 6(1)(b), (f) GDPR). Data may be automatically synchronised between CRM systems and other internal VigoImmobilien systems solely for the purpose of processing your enquiry.

Data transfer and place of processing

JustImmo and NetHunt act as processors of personal data on our behalf (Art. 28 GDPR); appropriate data processing agreements (DPAs) have been concluded with both providers. The provider JustImmo is registered in Austria; according to the provider’s own data protection information, a transfer of data to recipients in a third country (outside the EU) may occur in connection with the provision of the service. The provider NetHunt (NetHunt Inc.) is a company registered in the USA; processing data through this service constitutes a transfer to a third country. Data is technically stored on Google Cloud Platform infrastructure. In both cases where the transfer concerns a third country, it is carried out on the basis of the EU Standard Contractual Clauses (SCC) and/or other recognised data protection mechanisms.

Retention period

Data in the CRM systems is retained for the duration of the client enquiry and any subsequent statutory obligation to retain documentation, in accordance with the general retention periods set out in the Information Sheet above.

V. Client Identity Verification under Anti-Money Laundering Law (AML/KYC)

As a real estate broker, VigoImmobilien GmbH is subject to the Austrian Anti-Money Laundering and Counter-Terrorist Financing Act (Finanzmarkt-Geldwäschegesetz, FM-GwG) and § 365m1 GewO. These laws impose on us a statutory obligation to identify and verify clients prior to concluding a property transaction.

What we do

Prior to concluding a transaction (purchase, sale, or rental above the statutory threshold), we are required to identify the client, verify the legitimacy of the source of their funds, and determine whether the client is a politically exposed person (PEP) under the criteria of the FM-GwG. This is a mandatory check that cannot be waived at the client’s or the broker’s discretion.

What data is processed

• a copy of an identity document (passport, ID card);
• a registration confirmation of residence (Meldezettel) or equivalent document;
• documents relating to the client’s financial situation (proof of income, source of funds for the transaction);
• information on the client’s status as a politically exposed person (PEP), as well as, where relevant, family members or close associates within the meaning of the FM-GwG;
• the result of checks against sanctions lists and PEP lists (where applicable).

Legal basis

Performance of a statutory obligation under the FM-GwG and § 365m1 GewO (Art. 6(1)(c) GDPR). This processing does not depend on the client’s consent — without completing this verification, the transaction cannot lawfully be concluded.

Recipients of data

Data may be disclosed to competent authorities (in particular the Bundeskriminalamt / Geldwäschemeldestelle) in cases expressly provided for by law, as well as to auditors or supervisory authorities in connection with verifying our compliance with FM-GwG requirements. Data is not disclosed to third parties for commercial purposes.

Retention period

Documents and verification results are retained for the period set out in the FM-GwG (generally 5 years from the end of the business relationship or the transaction), irrespective of the general retention periods set out elsewhere in this document.

Your rights in this context

Due to the mandatory nature of this verification, the right to object and the right to erasure prior to the expiry of the statutory retention period are restricted in accordance with FM-GwG requirements. Other data subject rights (access, rectification) apply in the general manner described in the “Your Rights” section below.

VI. IP Telephony: Recording and Analysis of AI Assistant and Broker Calls

This section describes the planned use of an IP telephony system for recording and analysing telephone calls within the company. As at the date of publication of this text, the function for recording broker calls has not yet been technically activated.

What we do

We use an IP telephony system for making and receiving calls within the company. This system may process and analyse: (a) calls made by the automated AI voice assistant, as described in Section III of this document; and (b) telephone conversations between our broker staff and clients (incoming and outgoing calls), where recording is activated. The purpose of recording and analysing broker calls is to ensure quality control of client service and to improve consulting effectiveness.

What data is processed

• the caller’s telephone number, date and time of the call, and call duration;
• an audio recording of the call (subject to recording being activated) and, where necessary, a text transcript;
• the content of the conversation regarding the property enquiry (budget, location, property type, enquiry status).

Legal basis

With regard to the client: legitimate interest in ensuring service quality (Art. 6(1)(f) GDPR). The call is recorded only after the client has been notified at the start of the call and has given explicit consent. With regard to the broker (employee): recording of staff calls is activated only after the employee’s separate written consent has been obtained prior to the start of recording.

Retention period

Recordings of broker calls are retained no longer than necessary for quality control purposes, for a period equal to or shorter than that specified for AI calls in Section III (approximately up to 30 days), unless otherwise agreed separately with the broker.

Implementation status

The call recording function for the AI assistant has been implemented in accordance with Section III of this document. The call recording function for broker staff is not currently technically activated; it will be launched only after written consent has been obtained from each relevant employee.

Your Rights

We would like to inform and remind you that, as a data subject within the meaning of the GDPR, you have the right to obtain information (Art. 15), erasure (Art. 17), restriction of processing (Art. 18), rectification (Art. 16), data portability (Art. 20), as well as the right to object (Art. 21) and to withdraw your consent at any time with effect for the future (Art. 7(3)). To exercise your rights, please contact the controller named above at [email protected]. We would also like to draw your attention to your right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at) if you believe that we have violated your data protection rights. We are also happy to answer your questions and provide information at any time.