Privacy policy

This is a translation for your convenience. The legally binding version is the German privacy policy (Datenschutzerklärung).

This privacy policy applies to the website nussbaumerinvestmentclub.com, the member and registration area at members.nussbaumerinvestmentclub.com and all services of NIC Private Investor Society (Nussbaumer Investment Club): membership, mentoring, Circle and events. It explains which personal data we process, for what purpose, on what legal basis and what rights you have. Personal data is any information that can identify you personally, such as your name, email address or IP address.

1. Controller

The controller responsible for data processing is:

IMMOVENCE GmbH
Dr.-Karl-Lueger-Platz 5
1010 Vienna, Austria
Phone: +43 660 6794493
Email: hello@nussbaumerinvestmentclub.com

NIC Private Investor Society (Nussbaumer Investment Club) is a brand of IMMOVENCE GmbH. The controller is the legal entity that, alone or jointly with others, decides on the purposes and means of processing personal data. For any data protection questions, please contact us at the email address above.

We process your data on the basis of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

2. Overview

How do we collect your data?

On the one hand, you provide data yourself, for example when you request membership, register for an event or write to us. On the other hand, our IT systems automatically record technical data when you visit the website, such as browser, operating system or time of access. We only use analytics and marketing services if you have given your consent beforehand.

What do we use your data for?

Some data is required to provide the website securely and without errors. We use other data to handle your requests, to provide membership, mentoring and events, to communicate with you and, with your consent, to improve our services and our advertising.

Legal bases at a glance

• Consent (Art. 6 (1) (a) GDPR, for cookies and similar technologies additionally § 165 (3) TKG 2021)
• Contract or pre-contractual measures (Art. 6 (1) (b) GDPR), for example for membership, mentoring or ticket purchases
• Legal obligation (Art. 6 (1) (c) GDPR), for example retention obligations under tax and commercial law
• Legitimate interest (Art. 6 (1) (f) GDPR), for example in operating the website securely

3. Hosting and delivery of the website

Vercel

This website is hosted by Vercel and delivered via its global server network (content delivery network, CDN). The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the website, Vercel processes the technically necessary data, in particular your IP address, date and time, the page requested, referrer, browser and operating system, and stores it in log files (server logs).

We use Vercel on the basis of our legitimate interest in providing the website quickly, securely and reliably (Art. 6 (1) (f) GDPR). A data processing agreement is in place with Vercel. Transfers to the USA are based on the EU-US Data Privacy Framework and the Standard Contractual Clauses of the European Commission. Details: vercel.com/legal/privacy-policy.

To show you the website in your language, Vercel provides us with the country from which a page is requested. We use this information only to choose between German and English and do not store it.

If we activate Vercel's audience measurement (Web Analytics or Speed Insights), it works without cookies and without storing full IP addresses. It is used exclusively to measure visitor numbers and loading times.

Server log files

The following are recorded: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address. This data is not combined with other data sources. The logs are deleted automatically after a short period.

SSL / TLS encryption

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by “https://” and the lock symbol in your browser's address bar. Data you send to us therefore cannot be read by third parties.

4. Cookies and consent

What are cookies?

Cookies are small text files that are stored on your device and do not cause any harm. They are stored either for the duration of a session (session cookies) or permanently (persistent cookies) until you delete them or your browser removes them automatically. Other technologies such as pixels, local storage or device identifiers work in a similar way. We refer to all of them here as “cookies”.

Strictly necessary cookies

We use cookies that are strictly necessary to operate the website without consent (§ 165 (3) TKG 2021, Art. 6 (1) (f) GDPR). These include, for example, storing your cookie choices, security functions, logging in to the member area, storing the language you have chosen yourself (cookie “nic_lang”, one year) and an access cookie that allows our team to review a version of the website that has not yet been published.

Cookies requiring consent

All other cookies, in particular for statistics, analytics and marketing, are only used if you have consented via our cookie banner (Art. 6 (1) (a) GDPR, § 165 (3) TKG 2021). Without your consent, the corresponding services are not loaded. You can withdraw or change your consent at any time with effect for the future by opening the cookie settings again or deleting the cookies in your browser.

Consent management

We use a consent tool (consent banner) to request and store your consent. Your choice, the date and time and an anonymous identifier are stored so that we can respect and document your decision. The legal basis is our legal obligation to be able to demonstrate consent (Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR).

You can also set your browser to inform you when cookies are set, to allow cookies only in individual cases or to exclude them altogether. If cookies are deactivated, the functionality of this website may be limited.

5. Analytics and marketing

We use the following services exclusively with your consent (Art. 6 (1) (a) GDPR, § 165 (3) TKG 2021). They help us understand how our website is used and show our advertising to people who are interested in NIC. Consent can be withdrawn at any time.

Google Tag Manager

We use Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This tool allows us to integrate and control analytics and marketing services on the website. Tag Manager itself does not create user profiles or carry out analyses, but it does process your IP address, which may also be transferred to Google LLC in the USA. Through Tag Manager and Google Consent Mode we ensure that services only become active after your consent.

Google Analytics

We use Google Analytics 4 by Google. Google Analytics allows us to analyse visitor behaviour, such as page views, time spent, clicks, devices and operating systems used and approximate origin. Cookies or similar technologies are used for this, which make it possible to recognise your device. Google may combine this information in a profile assigned to your device.

In Google Analytics 4, IP addresses are shortened within the EU and not stored permanently. If we activate Google Signals, Google may link data across devices to your Google account if you are signed in and have allowed personalised advertising. User-level and event-level data is deleted after 14 months at the latest. A data processing agreement is in place with Google.

You can also prevent collection with Google's browser add-on: tools.google.com/dlpage/gaoptout. More information: support.google.com/analytics/answer/6004245.

Google Ads, conversion tracking and remarketing

We use Google Ads by Google to show advertisements in Google Search, on YouTube and on partner sites. Conversion tracking tells us whether a visitor performed a certain action after clicking an ad, for example requesting membership. We only receive aggregated statistics, not information that identifies you personally.

Remarketing allows us to show relevant ads in the Google network to people who have visited our website. For this purpose you are assigned to audiences based on your usage behaviour, which may be linked to Google's cross-device functions. If we use customer matching to build audiences, we only pass encrypted (hashed) contact data such as email addresses to Google if you have consented. You can manage your ad settings at adssettings.google.com.

Meta Pixel and Conversions API

We use the Meta Pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). It allows us to see which actions visitors take on our website and in our registration funnels after clicking an ad on Facebook or Instagram, to measure the effectiveness of our ads and to show relevant ads to visitors later (Custom Audiences). In addition, the Meta Conversions API may be used, which sends these events directly from the server to Meta. This, too, only happens with your consent.

For us the data collected is anonymous. However, Meta may link it to your user account and use it for its own advertising purposes. Where data is collected on our website and transmitted to Meta, we and Meta are jointly responsible (Art. 26 GDPR). Joint responsibility is limited to collection and transmission. The agreement is available at facebook.com/legal/controller_addendum. You can manage your ad settings at facebook.com/adpreferences. More information: facebook.com/privacy/policy.

LinkedIn Insight Tag

If we advertise on LinkedIn, we use the LinkedIn Insight Tag by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. It allows us to measure the effectiveness of our ads, receive aggregated statistics about visitors and show visitors ads on LinkedIn later. Opt-out: linkedin.com/psettings/guest-controls/retargeting-opt-out.

6. Registration funnels with Perspective

For membership requests, registrations for events such as IMMO × DINE and similar forms, we use registration funnels by Perspective Software GmbH, Berlin, Germany. You can find these pages at members.nussbaumerinvestmentclub.com.

We process the information you provide there, for example first and last name, email address, phone number, company, your interests, your current situation, your goals, details of your investment range and your answers in free-text fields. Technical data such as IP address, time and device are also recorded and, with your consent, cookies and tracking services (such as Meta Pixel or Google Tag Manager) are also loaded within the funnel.

We use this data to review your request or registration, to contact you and to provide the respective service. The legal basis is the performance of pre-contractual measures or a contract (Art. 6 (1) (b) GDPR), and your consent for voluntary information and tracking (Art. 6 (1) (a) GDPR). Perspective processes the data as a processor on servers in the EU. More information: perspective.co.

Data from the funnels may be transferred automatically to our customer management (CRM), our mailbox, our calendar or spreadsheets. For this we may use automation services such as Zapier (Zapier Inc., San Francisco, USA) or Make (Celonis, Prague, Czech Republic). The legal basis is our legitimate interest in handling your request efficiently (Art. 6 (1) (f) GDPR) and Art. 6 (1) (b) GDPR. Data processing agreements are in place with the providers. Transfers to the USA are based on the EU-US Data Privacy Framework or the Standard Contractual Clauses of the European Commission.

7. Enquiry form on this website

If you send an enquiry via a form directly on this website, we process your information including contact details in order to handle the enquiry and any follow-up questions. The information is sent to us by email. The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to a contract or pre-contractual measures; in all other cases it is our legitimate interest in handling enquiries addressed to us (Art. 6 (1) (f) GDPR) or your consent (Art. 6 (1) (a) GDPR).

To protect the form against spam and abuse, we store an encrypted short value of your IP address for no more than 15 minutes when you submit it, from which your IP address cannot be reconstructed (Art. 6 (1) (f) GDPR).

8. Contact by email, phone and messenger

Email and phone

If you contact us by email or phone, we store and process your enquiry including the personal data it contains (such as name, contact details, request) in order to handle your concern. The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to a contract, otherwise our legitimate interest (Art. 6 (1) (f) GDPR). For email, calendar and documents we use Microsoft 365 by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A data processing agreement is in place with Microsoft.

WhatsApp

To communicate with members, prospects and guests we also use WhatsApp by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for example in individual chats or in groups for members and events. Content is end-to-end encrypted. However, WhatsApp receives metadata such as sender, recipient and time and, according to its own information, shares data with Meta, including in the USA. The legal basis is our legitimate interest in fast communication (Art. 6 (1) (f) GDPR) or the performance of a contract (Art. 6 (1) (b) GDPR). In groups, other participants can see your phone number and name. Participation is voluntary. More information: whatsapp.com/legal/privacy-policy-eea.

9. Membership, mentoring and member area

If you become a member or book a mentoring format, we process the data required for this: master data such as name, address, contact details and company, contract and billing data, and information you share with us in the course of our work together, for example about your goals, property plans or financing questions. The legal basis is the performance of a contract (Art. 6 (1) (b) GDPR) and our statutory retention obligation (Art. 6 (1) (c) GDPR). We treat this information as strictly confidential.

For the member area we store your login data and the information technically required to sign in. Within the members' circle, your name, photo, company and short profile may be shown to other members if you wish. The legal basis is Art. 6 (1) (b) GDPR, and your consent for voluntary profile information (Art. 6 (1) (a) GDPR).

We only pass personal data to third parties where this is necessary to perform the contract, for example to the bank or payment service provider handling payments, to our tax advisers or, if you expressly wish, to partners such as financing advisers. We do not pass data on for advertising purposes without your consent.

10. Events

Registration and attendance

For registration for our events we process your contact details, where applicable information about accompanying persons, dietary wishes or intolerances, and payment data for paid tickets. We only process information about intolerances with your explicit consent (Art. 9 (2) (a) GDPR) and only for the respective event. Where necessary, we pass names and organisational details to the venue or caterer. The legal basis is Art. 6 (1) (b) GDPR.

Photos and videos

Photos and videos may be taken at our events, which we use on this website, on our social media profiles, in newsletters and in materials about NIC. We point this out in the invitation or on site. The legal basis is our legitimate interest in documenting and presenting our events (Art. 6 (1) (f) GDPR) or, for deliberate portrait shots, your consent (Art. 6 (1) (a) GDPR). If you do not wish to be photographed or would like a picture removed, please tell us on site or write to us. We will then remove the picture from our own channels.

11. Online meetings and appointment booking

For conversations, mentoring sessions and online events we use video conferencing tools such as Zoom (Zoom Communications Inc., San Jose, USA), Microsoft Teams (Microsoft Ireland Operations Limited, Dublin, Ireland) or Google Meet (Google Ireland Limited, Dublin, Ireland). We process the data you provide for this (such as name and email address), metadata such as start, end and number of participants, technical data such as IP address and device type, and content you share in the meeting. We only make recordings after prior notice and with the participants' consent.

We may use online booking tools to arrange appointments. In doing so we process your name, your contact details and the requested appointment. The legal basis is Art. 6 (1) (b) GDPR and our legitimate interest in straightforward communication (Art. 6 (1) (f) GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework or the Standard Contractual Clauses of the European Commission.

12. Newsletter and email updates

If you would like to receive our newsletter or event information by email, we need your email address and your confirmation that you own the address and agree to receive the emails (double opt-in). Further information is voluntary. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 174 TKG 2021). We may use an email service provider as a processor for sending, which also measures whether emails are opened and links are clicked.

You can unsubscribe at any time via the unsubscribe link in every email or by writing to us. After you unsubscribe, we may keep your email address on a block list to prevent future mailings (Art. 6 (1) (f) GDPR).

13. Social media

Links to our profiles

On this website we link to our profiles on social networks. These are simple links, not embedded plugins. Only when you click a link are you taken to the respective network, and only then does it receive data from you.

Our profiles on social networks

We maintain publicly accessible profiles on social networks, for example on Instagram and Facebook (Meta Platforms Ireland Limited, Dublin, Ireland), LinkedIn (LinkedIn Ireland Unlimited Company, Dublin, Ireland), YouTube (Google Ireland Limited, Dublin, Ireland) and TikTok (TikTok Technology Limited, Dublin, Ireland). When you visit these profiles, the operators can analyse your usage behaviour, even if you are not signed in, and use it to create profiles for interest-based advertising.

For the statistics functions (Insights) of our profiles we are jointly responsible with the respective operator (Art. 26 GDPR). You can assert your rights against us as well as against the operator, although the operator largely determines the data processing on its platform. The legal basis is our legitimate interest in a presence on social networks (Art. 6 (1) (f) GDPR). Details can be found in the operators' privacy policies: Instagram, Facebook, LinkedIn, YouTube, TikTok.

14. Embedded content and fonts

Fonts

All fonts on this website are hosted directly on our server. No fonts are loaded from Google or other providers when you open a page, and no data is transferred for this purpose.

Videos and maps

If we embed videos from YouTube or maps from Google Maps, they are only loaded after you have agreed to display them (Art. 6 (1) (a) GDPR). We embed YouTube videos in privacy-enhanced mode. Loading them establishes a connection to Google servers, transmits your IP address and may set cookies. The provider in each case is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Explainer video with Clipara

On the Mentoring page we embed an explainer video via the Clipara service. The provider is Clipara Ltd, United Kingdom. The video is only loaded when you click “Play video” or have allowed marketing cookies in the cookie banner. Before that, no data is transferred to Clipara. When it loads, your IP address, technical information about your browser and device and information about playback are transmitted to Clipara, and Clipara may set cookies or similar technologies to evaluate plays statistically. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 165 (3) TKG 2021), which you give by clicking or in the cookie banner and can withdraw at any time. An adequacy decision of the European Commission exists for the United Kingdom. More information: getclipara.com.

Links to other websites

This website contains links to websites of other providers, for example venues or partners. The respective operators are responsible for their content and data processing.

15. Transfers to third countries

Some of the providers mentioned are based in the USA or transfer data there. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework). Transfers to companies certified under it are therefore permitted. For recipients that are not certified, we rely on the Standard Contractual Clauses of the European Commission and additional safeguards where necessary. Please note that US authorities may under certain circumstances access data stored by US companies.

16. Retention period

Unless a more specific retention period is stated in this privacy policy, we store your data until the purpose of processing no longer applies. We generally delete requests that do not lead to membership or cooperation after twelve months at the latest. If you submit a justified request for deletion or withdraw consent, we delete your data unless there are legal grounds for longer storage. These are in particular retention periods under tax and commercial law of generally seven years (§ 132 BAO, § 212 UGB) or the duration of possible legal disputes. In these cases we delete the data once these grounds no longer apply.

17. Your rights

You have the right at any time to:

• access your stored data, its origin, recipients and the purpose of processing (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing, for example while the accuracy of your data is being checked or after you have objected (Art. 18 GDPR)
• data portability in a common, machine-readable format (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7 (3) GDPR). The lawfulness of processing carried out before withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

Where processing is based on our legitimate interest (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Where your data is processed for direct marketing, you may object at any time without giving reasons. This also applies to any related profiling. Your data will then no longer be used for direct marketing.

For any request, simply write to hello@nussbaumerinvestmentclub.com.

Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority. In Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

18. Objection to advertising emails

We hereby object to the use of the contact details published in the imprint for sending advertising and information material that has not been expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

19. Changes to this privacy policy

We adapt this privacy policy when our services, the services we use or the legal situation change. The version published here applies.

20. Cookies in use

The following overview is kept up to date automatically by our consent tool Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark). You can also change or withdraw your consent there at any time.

Last updated: October 2026