Technical and organisational measures (TOMs)

This annex describes the technical and organisational measures of the processor in connection with the provision and operation of ImmoVision.

The measures serve to protect personal data, in particular with regard to:

• Confidentiality
• Integrity
• Availability
• Resilience
• Recoverability
• Traceability
• Tenant separation
• Protection against unauthorised or unlawful processing
• Protection against accidental loss, accidental destruction or accidental damage

The measures are designed taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the varying likelihood and severity of the risks to the rights and freedoms of natural persons.

1. General security principles

The processor pursues the objective of processing personal data only to the extent necessary for the contractually owed service and of ensuring an appropriate level of protection through technical and organisational measures.

The security architecture of ImmoVision takes into account in particular:

• role-based access
• segregation of responsibilities
• tenant separation
• hardening of administrative access
• logging of security-relevant events
• backup and recovery concepts
• controlled engagement of sub-processors
• protection against data leakage, misconfiguration and misuse
• controlled use of AI, transcription and media processing functions

Insofar as Vertex AI / Generative AI on Google Cloud is used, security features such as data residency, CMEK, VPC Service Controls and Access Transparency may in particular be taken into account depending on the actual configuration; Google expressly documents these features for Vertex AI and Generative AI.

2. Physical access control

The aim of physical access control is to prevent unauthorised physical access to IT systems, servers, infrastructure components and administration environments.

Measures

• use of professional hosting and data centre infrastructure at Hetzner or the respective infrastructure operators used
• physical security measures of the data centres by the respective infrastructure operator
• restriction of physical access to administrative working environments to authorised persons
• organisational restriction of access to sensitive systems and operating environments
• separation between publicly accessible systems and internal administration environments, insofar as technically provided for

Insofar as hosting is provided by Hetzner, the TOMs and data centre measures documented by Hetzner apply in addition.

3. System access control

The aim of system access control is to prevent the use of systems by unauthorised persons.

Measures

• user accounts with individual access credentials
• password hashing in accordance with the current state of the art
• role- and permission-based authentication logic
• protection of admin and backend access
• session management and automatic invalidation, insofar as provided for by the system
• use of technical protection mechanisms against unauthorised login attempts
• separation of customer, team and administration access
• restricted assignment of administrative permissions
• use of technical access protection measures for internal administration areas
• two-factor login (code by e-mail or authenticator app, secret stored encrypted)
• device list per user with logout of individual devices; automatic logout after 90 days without use
• immediate termination of all sessions upon blocking, change of role or removal of a user

Insofar as Google Cloud / Vertex AI is used, additional protection may be provided via IAM, project-related permissions and – depending on the technical architecture – further cloud security mechanisms. Google documents Vertex AI-related security controls and access mechanisms separately.

4. Data access control

The aim of data access control is to ensure that authorised persons can only access the data they need to perform their tasks.

Measures

• role and permission concept
• tenant logic with separation between customers, teams, workspaces and admin areas
• differentiated permission models for users, team members, tenant administrators and system administrators
• restriction of read, edit, export and administration rights
• technical limitation of internal access to operational necessity
• internal permission check before access to sensitive data areas
• separation of customer dashboard and admin dashboard
• separate administration interfaces for operational and administrative purposes
• logging of security-relevant access, insofar as provided for
• visibility of leads, appointments, notes and voice notes according to role (e.g. personal notes only for the person who wrote them)
• time-limited, signed links for private files (e.g. identity documents, support attachments)

5. Disclosure control / transmission control

The aim is to prevent unauthorised reading, copying, alteration or removal of personal data during electronic transmission or storage.

Measures

• encrypted transmission of personal data using current transport encryption
• controlled API and backend communication
• access only via defined interfaces and authorised processes
• logging of security-relevant communication or processing events, where necessary
• restricted approval of external integrations
• organisational review and contractual safeguarding of sub-processors
• access credentials and keys of connected services are stored encrypted
• pseudonymisation of e-mail addresses, telephone and account numbers before transmission to the AI model in the WhatsApp assistant
• Content Security Policy on public pages; fonts and libraries from our own source

Insofar as Google Cloud / Vertex AI is used, the provider's respective cloud data protection and security documents are taken into account. For this purpose, Google refers to the Cloud Data Processing Addendum and to product-specific security and data protection documentation.

6. Input control / traceability

The aim is to be able to check and establish retrospectively whether and by whom personal data has been entered, altered or removed.

Measures

• logging of relevant system and administration events
• traceability of billing- and wallet-relevant movements
• event logging for security-relevant processes
• logging of usage, editing and administration operations, where necessary
• traceability of role changes, approvals and system-relevant configuration changes
• technical or organisational versioning or status logic, insofar as provided for by the system
• audit and error logs for system operation and support purposes
• audit log with chained checksums (subsequent changes are detectable)
• records of consents with the wording and checksum of the text

In the Google Cloud area – depending on the active configuration – supplementary mechanisms such as Access Transparency or further cloud audit functions may be used for traceability. Google documents Access Transparency as a supported security feature for Vertex AI.

7. Job control

The aim is to ensure that personal data is only processed in accordance with the controller's instructions.

Measures

• contractual provisions on processing on behalf
• documented description of services and processing
• limitation of processing to the agreed contractual and system purpose
• organisational separation between processing on behalf and the processor's own responsibility
• selection and engagement of sub-processors in accordance with data protection requirements
• internal processes for handling instructions and managing changes
• review, documentation and assignment of services used

Insofar as Google Cloud / Vertex AI are used as sub-processors, this takes place on the basis of the relevant cloud data protection documents and the contractual engagement. For this purpose, Google publishes both a Cloud Data Processing Addendum and a cloud sub-processor list.

8. Availability control

The aim is to protect personal data against accidental destruction, loss or impairment and to ensure recoverability.

Measures

• hosting in a professional server and infrastructure environment
• backup and recovery concepts
• monitoring of core technical systems, insofar as provided for
• measures for error detection and system stabilisation
• organisational and technical processes for recovery and incident handling
• separation of production and administration logic, insofar as provided for by the system
• protection against accidental deletion or uncontrolled overwriting
• controlled maintenance and update processes
• quarantine instead of immediate deletion of files; final deletion only after a set period
• deletion protection for files still referenced by a record

Insofar as Google Cloud is used, it should be taken into account that Google documents additional cloud security and control mechanisms for Vertex AI-related workloads.

9. Resilience and recoverability

The aim is to ensure resilient technical operation and timely recoverability after incidents.

Measures

• structured operating and restart processes
• organised handling of errors and incidents
• ability to restore from backups, insofar as provided for
• controlled release, maintenance and update processes
• technical separation of critical components according to functional logic, insofar as provided for in the system
• measures to limit single-point-of-failure risks, insofar as practicable

10. Separation requirement / tenant separation

The aim is to process data of different customers, workspaces, teams and roles in logically separate form.

Measures

• tenant-based data structure
• separation of customer areas and administrative areas
• role-based rights and visibility
• technical assignment of properties, leads, media, billing events and account data to the respective tenants
• restriction of cross-access to other tenants
• separate context and data logic for customer, team and admin functions

11. Pseudonymisation and data minimisation

Where possible and appropriate, data is only processed to the extent necessary for the respective purpose.

Measures

• restriction of processing to necessary data fields
• purpose limitation within the respective system function
• organisational limitation of internal inspection
• separation between productive use, support, logging and administration
• avoidance of unnecessary mass processing
• technical and organisational limitation of optional additional functions

12. Measures for AI, Vertex AI and Gemini-based processing

ImmoVision may use AI-supported functions, including text processing, image processing, staging, structuring, summaries, market analyses, workflow support and other generative AI functions.

Measures

• use of AI functions only within the scope of the booked and activated services
• organisational and technical control of the AI processes used
• separation between normal platform functions and administrative configurations
• logging of relevant AI-related operations, where necessary
• limitation of access rights to AI administration and system areas
• deliberate configuration of the cloud/AI regions used, insofar as technically provided for
• assessment and documentation of the AI sub-processors used
• no blanket approval for any third-party models or uncontrolled use of providers
• use of security and cloud control mechanisms depending on the production architecture
• AI functions can be switched on and off per agency and per person; paid functions only after the price has been displayed
• processing exclusively in EU regions (Google Vertex AI, Azure OpenAI)
• labelling of AI-generated content, confirmation and record per AI image before publication
• AI assistants on public pages only after consent; conversation histories 90 days

Google expressly documents security features such as data residency, CMEK, VPC Service Controls and Access Transparency for Vertex AI and Generative AI. Google also points out that certain generative AI security features are not supported for preview models.

13. Measures for retention, logging and zero/low-retention strategies with Vertex AI

Insofar as Vertex AI / Gemini are used, it should be taken into account that Google documents limited retention scenarios for certain Google models and at the same time describes measures to achieve zero data retention or the lowest possible retention.

Measures

• deliberate selection of the production model and cloud configuration
• review and documentation of active retention paths
• avoidance of unnecessarily activated additional functions with increased data retention
• controlled use of caching and session functions
• organisational assessment of whether project-related default caching functions should be deactivated
• limitation of additional search, grounding or session resumption functions, insofar as not required for the intended purpose
• documentation of storage and deletion concepts for AI-related processing

Google expressly documents limited retention scenarios for Vertex AI and describes the conditions under which zero data retention can be achieved.

14. Measures for transcription and voice processing

Insofar as transcription or voice-related processing is used, the following measures apply in addition:

Measures

• transcription functions only within the scope of activated product functions
• organisational responsibility of the customer for the legal admissibility of recordings and transcriptions
• controlled technical processing of audio, transcript and workflow data
• logging of relevant operations, where necessary
• limitation of access to audio and transcription data
• documentation of the technical configuration used
• restriction of optional additional functions, insofar as not required
• separate processing of billing/wallet data and the actual content data
• call recording only after an announcement and express consent of the other party
• audio of dictations, voice commands and live conversations is not stored
• retention of call recordings configurable per agency (default 30 days), followed by automatic deletion

15. Measures for video and media processing

Video clips are generated via Google Veo (Vertex AI, EU region) and assembled on our own servers or via the rendering service Shotstack. The following measures apply in addition:

Measures

• only the media and texts selected for the video are transmitted to Shotstack, as a rule no data of prospects
• transfer to Shotstack (Australia) on the basis of the EU Standard Contractual Clauses
• visible AI notice in AI-generated videos
• media only in the account folder of the respective agency; access only via authorised roles
• making recognisable faces unrecognisable before AI image editing, where provided for
• logging of processing operations and resumption after disruptions

16. Measures for wallet, billing and usage events

ImmoVision may process credit, billing and usage events.

Measures

• separate wallet/billing logic
• traceable booking and movement logs
• event logging for billing-relevant operations
• restriction of manual interventions to authorised administrative roles
• documentation of corrections, refunds and adjustments
• separation between customer view and admin view
• limitation of access to billing-relevant records

17. Review, assessment and further development

The processor regularly reviews the technical and organisational measures and develops them further on a risk-oriented basis.

Measures

• regular assessment of the existing security measures
• further development according to technical, organisational or legal necessity
• adaptation to changed functions, cloud services, workflows or security situations
• documentation of material changes, where necessary

18. Sub-processors and external security documentation

Insofar as sub-processors are used, they are carefully selected and engaged in compliance with data protection law.

Insofar as hosting is provided via Hetzner, the TOMs and data processing documents documented by Hetzner apply in addition. Hetzner itself refers to its TOM documentation as part of its data processing agreement.

Insofar as Google Cloud / Vertex AI / Gemini / Speech-to-Text are used, the relevant data protection, security and sub-processor documents of Google Cloud apply in addition. Google documents in particular the Cloud DPA, sub-processors, security controls and product-specific retention notes.

19. Concluding remark

The above measures represent the framework of technical and organisational safeguards for ImmoVision envisaged as at the date of this document. The processor is entitled to further develop or adapt these measures or to replace them with equivalent measures, provided that the contractually and legally owed level of protection is not undercut.