Privacy policy

This privacy policy describes which personal data we process when you visit our website scalehousing-systems.com, use one of our enquiry forms or log in to our partner or customer portal at app.scalehousing-systems.com, and on what legal basis, for how long and with which rights for you.

Version: 09.10.2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

KMS 24 UG (haftungsbeschränkt)
Oberstraße 3
47829 Krefeld
Germany
represented by the managing director Kevin Matynski

Email: info@scalehousing-systems.com
Phone: +49 1512 2992298

You can also reach us at these contact details with any questions about data protection and the exercise of your rights.

2. Hosting, server log files and data security

The website, enquiry forms, our CRM system at app.scalehousing-systems.com and our mail server run on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, in a data centre in Germany. IONOS processes the data solely on our behalf (Art. 28 GDPR).

Each time our pages are called up, the web server automatically stores the following details in log files (server log files):

  • IP address of the requesting device
  • date and time of access
  • address called (URL), HTTP status code and amount of data transferred
  • page visited before (referrer), if your browser transmits it
  • browser and operating system (user agent)

We need these details to deliver the pages, fix errors and detect and repel attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and stable operation. The log files are deleted regularly as part of the server's automatic log rotation. We keep individual entries longer only as long as we need them to clarify a specific security incident.

We transmit all pages and forms exclusively in encrypted form (HTTPS/TLS). Only logged-in, authorized persons with role-based rights have access to the CRM system.

3. Cookies and storage on your device

Our website scalehousing-systems.com sets no cookies itself and uses no analytics, tracking or advertising services. Information is stored on or read from your device only in the following cases:

  • Forms and portal at app.scalehousing-systems.com: As soon as a form provided there is loaded, also when embedded in a page of our website, and when you log in to the portal, our CRM system sets the cookies scalehousing_app_session (session) and XSRF-TOKEN (protection against forged form submissions). Both expire after two hours. They are strictly necessary for the form and portal to work (§ 25(2) no. 2 TDDDG); the legal basis of the related processing is Art. 6(1)(f) GDPR.
  • Referral links from sales partners: We store nothing on your device for this. The partner reference appears only in the address of the page called up (section 9). A cookie previously set for this is no longer evaluated by us, and we delete it when you call up a referral link again.
  • Project planner and contact form of the website: These pages place entries in your browser's session storage (sessionStorage). They stay on your device and do not go to us automatically. scalehousing-project-v13 contains the project wishes put together in the project planner (model, offer route, units, site, specification wishes) so that they are kept when you change pages and can be transferred into the enquiry; we no longer use entries older than 24 hours. scalehousing-submission-v1 contains a random enquiry ID and a check value of your entries (not the entries themselves), so that sending the same enquiry again after a connection error does not create a second enquiry. You can delete these entries via "Remove transferred project wishes" on the contact page, by closing the browser tab or window, or in the browser settings; we also remove the project wishes after an enquiry is sent, and the enquiry ID after a successful send. You can also download the project wishes from the project planner as a file to your device; this file is then only with you.
  • Security check on the enquiry forms (Cloudflare Turnstile): Only when you use a form does your browser load the check script from challenges.cloudflare.com. For the check, Cloudflare may store or read technically necessary information in your browser (section 5).

You can delete cookies in your browser at any time or block their storage. Without the two necessary cookies, the forms of the CRM system and the portal cannot be used.

4. Fonts, images and downloads

We deliver fonts, images and PDF downloads from our own server. When a page is called up, your browser makes no connection to third-party servers for this, in particular not to Google Fonts. You can download the PDF files (end-customer brochure, product overview) without registration and without a form; we collect no details about you in doing so, only the server log files under section 2 arise.

5. Website contact forms, email and phone

On the "Contact" page you can send us an enquiry through a form (the "Project wishes" page and other pages refer to it). We process name, email address and the interest chosen (mandatory details) as well as your message (mandatory, except for transferred project wishes and for "Housing idea") and, voluntarily, company, phone number, project site, plot status and the number of units wanted as an exact figure. In addition we transmit a random enquiry ID and the origin of the enquiry (e.g. "Contact", "Project wish" or the page you came from). Also included are your confirmation by checkbox to the privacy policy and the language of the page. If you came via the referral link of a sales partner, we also pass on the partner reference from the page address (section 9).

If you have transferred project wishes from the project planner into the enquiry, we transmit them with the enquiry as structured details: model, offer route, number of dwellings, for modular projects the number of modules and the layout concept, site, plot status as well as your wishes on facade, specification, energy, smart home, service and care. You can change units and site on the contact page before sending; what is transmitted is the state at the time of sending. Our server checks these details and accepts only known fields; we do not accept price and area details from the browser. These are non-binding project wishes, not a quote.

Our web server passes the details directly to our CRM system on the same server. There we create the enquiry and send you an automatic confirmation of receipt by email (section 8). If the CRM system is temporarily unreachable, we always secure the enquiry in a file on the server protected against retrieval and additionally send it by email to our mailbox info@scalehousing-systems.com. We show a success message only when the CRM system has accepted the enquiry or the file has secured it. If the CRM system rejects an enquiry permanently, we show an error message and your entries stay in the form. As soon as we have transferred the enquiry from there into the CRM system, we delete it from this file; we delete the copy with which we check the transfer after 30 days.

Against automated mass enquiries we use a check field invisible to humans (honeypot) and allow at most five enquiries in ten minutes from the same IP address. For this we do not store the IP address in plain text but as a hash value together with the times of the enquiries. The counters apply for ten minutes and are deleted after one day at the latest.

If you write us an email or call us, we process your details in the same way to handle your request.

The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a quote or a contract, and otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries and preventing misuse of the forms). Without the mandatory details we cannot handle your enquiry.

To protect against automated mass enquiries, a security service from Cloudflare (Turnstile) checks whether the enquiry comes from a human. Your browser loads its script from challenges.cloudflare.com only when you use the form. Cloudflare processes your IP address and technical features of browser and device that are needed for the check, and issues your browser a one-time check result (token). Our server queries this result at Cloudflare and transmits the token and IP address for it; we handle the enquiry only if the check is passed. We do not store the token. Without a passed check we cannot accept the enquiry; your entries stay in the form, and you can reach us by email or phone instead. The legal basis is Art. 6(1)(f) GDPR (our interest in preventing misuse of the forms and spam). Cloudflare is a recipient (section 12).

6. Enquiry forms of our CRM system

We provide some forms directly from our CRM system at app.scalehousing-systems.com: for example the project enquiry on the page /en/new-housing (there as an embedded frame, a so-called iframe, which is loaded only when you choose "Open project form"), the form for the initial tax check and the enquiry forms on the pages of our sales partners (app.scalehousing-systems.com/p/…). You see in each form which details are asked for and which are mandatory. As a rule these are contact details (name, email address, phone number, company, website) and details about the project (type of project, site, planned use, number of modules, project status, budget and timeframe, preferred form of contact, message).

For each enquiry the CRM system also stores:

  • campaign parameters from the address of the page called up, if present (utm_source, utm_medium, utm_campaign, utm_content, utm_term, a QR code marker and the click IDs gclid and fbclid)
  • the address of the page on which you called up the form and the page visited before (referrer)
  • the language of the form and the identifier of your browser (user agent)
  • a hash value (SHA-256) of your IP address formed with a secret key; we do not store the IP address itself with the enquiry
  • the time of the enquiry and of your confirmations or consents
  • for an enquiry via the referral link of a sales partner, the assignment to that partner (section 9)

With these details we evaluate which campaign, QR code or page enquiries reach us through. We use no external analytics services for this and do not pass the details on to Google, Meta or other advertising networks.

Against automated enquiries we use an invisible check field (honeypot) and a signed time token that detects forms sent too fast. We also limit the number of submissions per IP address and per email address; the counters exist only as hash values and expire after a few minutes. For the duration of a session, the CRM system stores your IP address and browser identifier on the server; this session data is deleted after the session ends in the regular automatic clean-up.

The legal basis for handling your enquiry is Art. 6(1)(b) GDPR (pre-contractual measures at your request). For campaign evaluation, spam protection and session data it is Art. 6(1)(f) GDPR; our legitimate interest lies in measuring the effect of our advertising without external services and protecting our forms from misuse.

7. Downloads and the former trade fair page

The current PDF documents (end-customer brochure, product overview) can be retrieved on the "NEW HOUSING" and "Camping & glamping" pages without a form and without registration (section 4). The former page /de/messe/ redirects to /en/new-housing; a form to request the project information brochure is currently not integrated there on the website, and the brochure as a file remains available at its previous address. For the server-side processing route of this form, which still exists, the following applies: we collect your name and email address as well as campaign parameters from the page address, if present (utm_…, QR code marker, partner reference under section 9). Only your agreement that we process your details for the download request is mandatory. Consent that we may inform you by email about our product and suitable projects is voluntary: you receive the information brochure without it too, and without it we send you no marketing emails.

After sending, you receive the information brochure and a confirmation email. We create the enquiry in our CRM system and inform our team internally by email. If the CRM system is not reachable, we secure the details in a file on the server protected against retrieval and delete them there as soon as we have transferred them into the CRM system; we delete the copy with which we check the transfer after 30 days.

The legal basis for providing the information brochure is Art. 6(1)(b) GDPR, for email marketing your consent, if you have given it (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). You can withdraw your consent at any time (section 10).

8. Handling in the CRM system and internal prioritization

We handle all enquiries in our own CRM system on the server named in section 2. There

  • we create the enquiry with contact and, if given, company, and check whether an enquiry from you already exists, to merge duplicate entries;
  • we send you an automatic confirmation of receipt by email and notify the responsible people in our team;
  • we document conversations, emails, tasks, appointments and quotes relating to your enquiry;
  • we log changes to the records so that it stays traceable who changed what and when. We delete the entries of this change log automatically after 365 days.

From your details, such as project size, budget and timeframe, project status, type of project and callback request, the system automatically calculates an internal figure (lead score). It helps us decide which enquiry to handle first. The score has no legal effect on you and does not affect you in a similar way; a person handles every enquiry. No automated individual decision within the meaning of Art. 22 GDPR takes place.

The legal basis is Art. 6(1)(b) GDPR. For duplicate checks, the change log and the lead score it is Art. 6(1)(f) GDPR; our legitimate interest lies in orderly, traceable and prompt handling. Only the people in our team who handle your enquiry have access and, in the case of section 9, the responsible sales partner.

In our CRM system we can assign several enquiries and quotes (for example on land, housing need, operation, financing or delivery) to a joint project. Our team checks and proposes connections and possible participants; there is no public search and no public marketplace for this, and we do not send proposals automatically to third parties. We pass on details about you to other participants in a project only after your express release; we set up access to projects and documents in the portal (section 11) expressly per user and project.

9. Sales partners: referral links and assignment of enquiries

We work with sales partners who receive a commission for projects they refer. So that we can assign an enquiry to the right partner, we process the following:

Referral link with partner reference

Partners link to us through personal links of the form app.scalehousing-systems.com/r/…. If you call up such a link, our CRM system redirects you to our website and appends a partner reference to the address (?ref=…). It contains only the partner's short code, an expiry date 60 days after the call-up and a signature with which we detect forged or altered references. It contains no details about you. We store nothing on your device in doing so: neither a cookie nor an entry in your browser's local or session storage for the partner reference (for the other session storage entries of the website see section 3). If you click on within our website, the internal links carry the reference along in the address. If you call up our website later without the reference, or if it has expired, no assignment takes place.

If you send an enquiry with the reference in the address, through a contact form of the website (section 5), the project information brochure (section 7) or a form of our CRM system (section 6), the reference is sent along. The CRM system checks signature and expiry date and assigns the enquiry to the partner. We store the assignment only together with your enquiry. If you send no enquiry, only the visit count remains of your visit.

Visit count

When a referral link or a partner page (app.scalehousing-systems.com/p/…) is called up, we count the visit for the partner's statistics. Stored are partner, time, language, the page visited before (referrer), the browser identifier and a hash value of your IP address formed with a secret key. With this pseudonymous value we count repeated calls within 30 minutes only once; we do not store the IP address itself. The partner sees only the number of visits. After twelve months we delete the entries automatically.

Partner access

If your enquiry is assigned to a partner, through the partner reference or because you used the form on the partner's page, the partner can view it in their partner area: name, email address, phone number, type of project, site, number of modules, your message, the date received and the processing status with us. We inform them of a new enquiry by email with your name and the type of project. This way they can support you together with us and trace their commission.

The legal basis for assignment, visit count and the partner's access is Art. 6(1)(f) GDPR. Our legitimate interest lies in settling referrals correctly and supporting you in coordination with the referring partner. If your enquiry aims at a quote or a contract in which the partner is involved, the legal basis for their access is additionally Art. 6(1)(b) GDPR. You can object to processing based on point (f) (section 15).

10. Email marketing and withdrawal of your consent

Some forms contain a consent that we may inform you by email about our products, project examples and events. It is always voluntary, also for the project information brochure (section 7), and no precondition for an enquiry or a download. We store the time of your consent as proof and send marketing emails only if it exists. We send our emails through our own mail server, without tracking pixels and without external sending providers. We do not currently offer a newsletter with its own sign-up.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). You can withdraw it at any time without giving reasons, with effect for the future, for example by email to info@scalehousing-systems.com. The lawfulness of the processing carried out until then remains unaffected.

11. Partner and customer portal

At app.scalehousing-systems.com we operate an area for sales partners (/partner), a portal for project customers (/portal) and an internal administration area (/admin). For an account we process name, email address, a password stored only as a hash value, the assignment to your company and your role as well as the content you post or retrieve there, such as project documents, messages in the internal chat and the status of enquiries. For sales partners, commission details are added.

Sales partners can register themselves; we check every registration before we activate access. We set up customer access and send the contact person a link valid for 48 hours through which they set their own password. In the portal we set the necessary cookies named in section 3. We store sessions on the server with IP address and browser identifier; we log changes to records.

The legal basis is Art. 6(1)(b) GDPR (partner or customer contract and its initiation), for security and logging Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the accounts and in the traceability of changes.

12. Recipients and transfers to third countries

We process your data ourselves as a rule. Recipients are only:

  • IONOS SE, Montabaur, as processor for operating the server (section 2);
  • the sales partner to whom your enquiry is assigned (section 9);
  • Cloudflare, Inc., USA, as provider of the Turnstile security check, only if you use an enquiry form (section 5);
  • authorities and courts where we are legally obliged to, and advisers bound to secrecy where this is necessary to establish, exercise or defend legal claims.

We do not sell data and do not pass it on to third parties for advertising purposes. Except for the Turnstile security check, we do not transfer data to countries outside the European Union or the European Economic Area. Cloudflare is a US company; processing in the USA is possible. The transfer relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework where Cloudflare is certified under it, and otherwise on standard contractual clauses (Art. 46 GDPR).

13. Storage period

We store personal data only as long as is necessary for the purpose in question:

  • Enquiries and contact details: as long as we handle your enquiry and initiate or maintain a business relationship. If no project comes about and further contact is no longer foreseeable, we delete the data. You can demand deletion at any time.
  • Business records such as quotes, contracts, invoices and business letters: until the commercial and tax retention periods expire (§ 257 HGB, § 147 AO; six, eight or ten years depending on the document). During this time we limit processing to retention.
  • Proof of consent: as long as we act on its basis and afterwards as long as we must be able to prove the consent.
  • Accounts in the partner and customer portal: for the duration of the cooperation; afterwards we delete them unless retention duties stand in the way.
  • Assignment of an enquiry to a sales partner: as long as the enquiry itself.
  • Visit count for partners: twelve months; afterwards we delete the entries automatically.
  • Change log in the CRM system: 365 days; afterwards we delete the entries automatically.
  • Browser session storage (project wishes, enquiry ID): on your device until you remove them, close the tab or window, or send the enquiry successfully; we no longer use project wishes after 24 hours (section 3).
  • Fallback files of the website forms: until we have transferred the enquiry into the CRM system; we delete the control copy of the transfer after 30 days.
  • Spam counters of the website forms: valid for ten minutes, deleted after one day at the latest; the counters of the CRM system expire after a few minutes.
  • Server log files and session data: as described in sections 2 and 6.

14. Your rights

You have the right against us to

  • access to the data stored about you (Art. 15 GDPR),
  • rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • object to processing (Art. 21 GDPR, section 15),
  • withdraw a consent given, with effect for the future (Art. 7(3) GDPR).

An informal message to info@scalehousing-systems.com is enough. If there are justified doubts about your identity, we may request additional details so that we give information only to the authorized person.

15. Right to object

If we process your data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can object to the processing of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR). We then no longer use your data for this purpose.

16. Right to lodge a complaint with a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Web: www.ldi.nrw.de

17. Changes to this privacy policy

We adapt this privacy policy when our website, our forms or the legal situation change. The version published on this page at the time applies.