Privacy policy

Last updated: 1 October 2026

1. Controller

The controller responsible for the processing of personal data on this website (wolsteingasse.at) is:

WOL Lead Invest GmbH (Lead Invest Group)

Neustift am Walde 86/16, 1190 Vienna, Austria

VAT ID: ATU 78148309

Email: office@leadinvest.at

Phone: +43 670 301 5708

A data protection officer is not required by law and has not been appointed. Please send data protection requests to the email address above.

2. Principles

We process personal data only in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This policy explains which data we process when you visit the website, send us a request or stay in contact with us, for what purpose, on which legal basis, for how long, and which rights you have.

Legal bases we rely on:

  • Art. 6(1)(a) GDPR – your consent (e.g. cookies, newsletter)

  • Art. 6(1)(b) GDPR – steps prior to entering into a contract and performance of a contract (e.g. exposé request, consultation, viewing)

  • Art. 6(1)(c) GDPR – legal obligations (e.g. retention duties)

  • Art. 6(1)(f) GDPR – legitimate interests (e.g. secure operation of the website, spam protection)

  • § 165(3) TKG 2021 – storing information on, or accessing information stored in, your device (cookies) only with consent, except where technically necessary

3. Hosting and server log files (Shopify)

This website runs on the e-commerce platform Shopify. Provider: Shopify International Limited, 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. When you access the website, the following data is automatically processed in server log files: IP address, date and time, page requested, data volume transferred, browser type and version, operating system, referrer URL. Purpose: delivery of the website, security, error analysis. Legal basis: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Shopify deletes log files after a short period.

Shopify also processes data in Canada (EU adequacy decision) and in the USA; Shopify's US entities are certified under the EU-US Data Privacy Framework (DPF). A data processing agreement is in place with Shopify. More information: https://www.shopify.com/legal/privacy

4. Cookies and consent (cookie banner)

On your first visit we show a cookie banner with the options "Accept all", "Necessary only" and "Settings". Technically necessary cookies are set without consent (§ 165(3) TKG 2021, Art. 6(1)(f) GDPR). Analytics and marketing services (Microsoft Clarity, Meta Pixel, Klaviyo) are only loaded after you have expressly agreed in the banner (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Without your consent these services are not loaded and no related cookies are set.

Your decision is stored locally in your browser (local storage, entry "wlg_cc") for a maximum of 12 months; after that we ask again. You can change or withdraw your consent at any time with effect for the future via the "Cookie settings" link in the website footer. On withdrawal, the cookies of the services concerned are deleted and the services are disabled.

4.1 Technically necessary cookies (no consent required)

  • Shopify: _shopify_y, _shopify_s, _secure_session_id, localization, cart, keep_alive, _tracking_consent, _cmp_a – session, language/country selection, security, storage of your cookie decision. Duration: session up to 1 year.

  • hCaptcha (Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA): spam and bot protection for our forms. Processes IP address, browser and device information and interaction data. Legal basis: legitimate interest in protection against abuse (Art. 6(1)(f) GDPR). Transfer to the USA based on the EU-US Data Privacy Framework or the EU standard contractual clauses. https://www.hcaptcha.com/privacy

4.2 Analytics (only with consent) – see section 5

4.3 Marketing (only with consent) – see sections 6 and 7

5. Analytics: Microsoft Clarity

With your consent we use Microsoft Clarity (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; parent company Microsoft Corporation, Redmond, USA) to understand how visitors use our website: heatmaps, scroll and click behaviour and anonymised session recordings. This processes your IP address (truncated), device and browser information, pages visited, interactions and time on site. Input in form fields is masked and not recorded.

Cookies: _clck, _clsk (up to 1 year), CLID (1 year), ANONCHK, MR, MUID, SM (Microsoft domains, up to 1 year).

Legal basis: your consent (Art. 6(1)(a) GDPR). Transfer to the USA: Microsoft is certified under the EU-US Data Privacy Framework. Withdrawal: via "Cookie settings" in the footer. More information: https://privacy.microsoft.com/en-us/privacystatement and https://learn.microsoft.com/clarity/

6. Marketing: Meta Pixel, Meta Conversions API and Meta Ads

6.1 Meta Pixel

With your consent we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). It allows us to measure the effectiveness of our ads on Facebook and Instagram, to show relevant ads to visitors of our website (remarketing) and to build audiences with similar interests. The pixel collects: pages visited, device and browser information, IP address, Meta cookie IDs (_fbp, _fbc; 90 days) and the following events: page view, view of an apartment page, opening of the exposé form and successful submission of a request. Your answers in the exposé form (e.g. time frame, financing, apartment preferences) are not transmitted to Meta.

6.2 Advanced Matching and Conversions API

If you have consented to marketing cookies and successfully submit a request, we additionally transmit your email address, phone number, first name and last name to Meta in hashed form (SHA-256, non-reversible) so that Meta can attribute the request to a Meta account ("Advanced Matching"). The same event is also sent server-side via the Meta Conversions API together with your IP address, browser identifier and the Meta cookie IDs; this transmission is carried out through our processor Make (section 8). Both transmissions take place only with your consent.

6.3 Joint controllership and transfers to third countries

We and Meta are joint controllers for the collection and transmission of this data (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. Meta may transfer data to the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR). Withdrawal: via "Cookie settings" in the footer. More information: https://www.facebook.com/privacy/policy and https://www.facebook.com/adpreferences

6.4 Meta Ads (advertising on Facebook and Instagram)

We run ads through Meta Ads. If you reach our website via an ad, Meta processes your interaction with the ad under its own privacy policy. On our website the click parameter (fbclid) is only processed if you have consented to marketing cookies. We do not upload customer lists to Meta unless you have expressly consented.

7. Marketing: Klaviyo (email marketing and website forms)

For newsletters, project information by email, sign-up forms on the website and the management of prospect data we use Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA ("Klaviyo").

7.1 Newsletter and project information

If you sign up for information via a form or tick the optional box "I would like to be informed by email about future projects" in the exposé or consultation form, we store your email address, your name where provided, the time of sign-up, your IP address and the wording of the consent (proof). Legal basis: your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). You can withdraw your consent at any time via the unsubscribe link in every email or by email to office@leadinvest.at. Without this consent you will not receive advertising from us.

7.2 Measurement in emails

Our emails contain tracking pixels and personalised links that let us evaluate whether an email was opened and which links were clicked. This evaluation is part of the newsletter consent; if you do not wish it, you can unsubscribe at any time.

7.3 Klaviyo on the website (only with consent)

If you have consented to marketing cookies, Klaviyo loads a script on the website that displays sign-up forms and assigns browsing behaviour (pages visited, apartments viewed, form interactions) to a profile associated with you, provided you have given us your email address. Cookies: __kla_id (Klaviyo ID, 2 years), __kla_off (unsubscribe, 1 year). Without consent the script is not loaded. Legal basis: your consent (Art. 6(1)(a) GDPR). Withdrawal: via "Cookie settings" in the footer.

7.4 Transfers to third countries

Klaviyo processes data in the USA. Klaviyo, Inc. is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition. A data processing agreement is in place with Klaviyo. More information: https://www.klaviyo.com/legal/privacy/privacy-notice

8. Requests: exposé form, consultation and contact form, Make, Google Sheets

8.1 Which data

Through the exposé form ("Unlock prices & floor plans"), the consultation form ("Personal consultation") and the contact form we collect: first and last name, email address, phone number, your preferences (use, size, outdoor space, planned purchase period, financing situation), the apartment requested, the website language, date and time and, where applicable, your message. For evidence purposes we store the wording of the consents and the time they were given.

8.2 Purpose and legal basis

Unlocking prices, floor plans and the financing calculator on the website, sending documents, personal consultation, call-back and appointment scheduling. Legal basis: steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) and your consent to be contacted by email and phone (Art. 6(1)(a) GDPR), given when you submit the form. The mandatory fields are required for processing; without them we cannot answer your request.

8.3 Processing and recipients

  • Shopify (section 3): transmission of the request by email to our sales team and storage as a customer record.

  • Make (Celonis Make s.r.o., Na Poříčí 1067/25, 110 00 Prague 1, Czech Republic; servers in the EU): automated forwarding of the request to the systems listed below. Make stores the data only temporarily for processing.

  • Google Sheets (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): internal prospect list for our sales team. Google LLC is certified under the EU-US Data Privacy Framework.

  • Klaviyo (section 7): creation of a prospect profile; email advertising only with separate opt-in.

  • CloudTalk (section 9): creation of the contact for the phone call-back.

  • Meta (section 6.2): hashed contact data, only with marketing consent.

  • The licensed real estate brokers engaged by Lead Invest Group who handle your request personally.

Data processing agreements (Art. 28 GDPR) are in place with all service providers.

8.4 Retention

We store request data for the duration of processing and then for up to 24 months after the last contact if no contract is concluded. If a contract is concluded, statutory retention periods apply (in particular 7 years under § 132 BAO and § 212 UGB).

9. Telephony: CloudTalk

For calls, call-backs and WhatsApp/SMS communication with prospects we use the cloud phone system CloudTalk (CloudTalk.io s.r.o., Rybná 716/24, 110 00 Prague 1, Czech Republic; servers in the EU). We process: phone number, name, date, time and duration of the call, call notes by our staff and the status of the request. Purpose: answering your request, consultation, appointment scheduling and documentation of the contact. Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in traceable customer care (Art. 6(1)(f) GDPR).

Call recording: phone calls are only recorded if we inform you at the start of the call and you agree (Art. 6(1)(a) GDPR). You may refuse the recording at any time; the call then continues without recording. Recordings are deleted after 6 months at the latest.

A data processing agreement is in place with CloudTalk. More information: https://www.cloudtalk.io/privacy-policy/

10. Contact by email, phone and WhatsApp

If you contact us by email, phone or via the WhatsApp link on the website, we process the data you provide (name, contact details, content of the message) to answer your request (Art. 6(1)(b) GDPR). On WhatsApp your data is processed by WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, under its own privacy policy; using WhatsApp is voluntary – you can always reach us by phone or email instead. Retention as in section 8.4.

11. Disclosure and transfers to third countries

We disclose data only to the processors named in this policy, to the brokers engaged by Lead Invest Group for sales, to the developer or seller of the apartment in the course of contract preparation, or where legally required. Transfers to the USA take place only to companies certified under the EU-US Data Privacy Framework or on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR).

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal is not affected. Please send requests to office@leadinvest.at or by post to the address in section 1. We respond within one month.

If you believe that the processing of your data violates data protection law, you may lodge a complaint with the Austrian Data Protection Authority: Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, phone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.

13. Data security

The website is delivered exclusively over HTTPS (TLS encryption). Access to prospect data is limited to staff and brokers who need it to handle requests.

14. Changes

We update this privacy policy whenever the services used or the legal situation change. The version published on this page applies.

 

WhatsApp