Privacy Policy

Last updated: 8 September 2026

This Privacy Policy explains how personal data is collected, used, stored and otherwise processed when you visit varhor.com, create or use a Varhor account, purchase or manage a subscription, access the Varhor member area, contact us, or otherwise interact with Varhor.We process personal data in accordance with applicable data protection law, in particular Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”) and applicable German data protection law.

1. Controller

The controller responsible for the processing of personal data in connection with Varhor is:
Diana Bagdasaryan
Varhor – Real Estate Market Intelligence
Bismarckstraße 19 A
32756 Detmold‍
Germany

Email: info@varhor.com
‍Website: www.varhor.com

‍References in this Privacy Policy to “Varhor”, “we”, “us” or “our” refer to the controller identified above.

2. Categories of Personal Data We Process

Depending on how you use Varhor, we may process the following categories of personal data:
- name and contact details
- email address;account and authentication information
- membership and subscription information
- billing address
- tax identification information, where applicable
- payment and transaction information
- subscription status and payment history
- information submitted through contact forms or other communications
- technical information such as IP address, browser type, device information, operating system, date and time of access and referring URL
- information required for website security, authentication, fraud prevention and abuse prevention
- information voluntarily provided by you through your account or communications with us.

We do not intentionally request special categories of personal data within the meaning of Article 9 GDPR through the regular operation of Varhor.

3. Sources of Personal Data

We generally receive personal data:
- directly from you, for example when you create an account, purchase a subscription or contact us
- automatically when you access or use our website and member area
- from service providers involved in providing our services, particularly Memberstack and Stripe, for example in connection with account status, subscriptions and payments.

We do not purchase personal data about Varhor users from data brokers.

4. Purposes and Legal Bases of Processing

We process personal data only where a lawful basis applies.

Performance of a contract – Article 6(1)(b) GDPR

We process personal data where necessary to:
- create and manage Varhor accounts
- authenticate members
- provide access to paid or protected content
- administer memberships
- process and manage subscriptions
- provide purchased digital services
- manage billing
- respond to requests relating to an existing or prospective contractual relationship.

Compliance with legal obligations – Article 6(1)(c) GDPR

We process personal data where necessary to comply with legal obligations, including applicable:tax requirements;accounting obligations;commercial record-keeping obligations;legally binding requests from competent authorities.

Legitimate interests – Article 6(1)(f) GDPR

Where appropriate, we process personal data on the basis of our legitimate interests, including:
- operating and securing the Varhor website
- preventing fraud, abuse and unauthorised access
- maintaining the stability and technical security of our services
- responding to general enquiries
- protecting our legal rights
- establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider whether your interests, rights or freedoms override those interests.

Consent – Article 6(1)(a) GDPR

Where a processing activity requires consent, we will request it separately.Consent may be withdrawn at any time with effect for the future.These legal bases correspond to Article 6 GDPR.

5. Provision of Personal Data

Certain personal data is necessary in order to provide Varhor services.
For example:
- an email address and authentication information are required to create and use a Varhor account
- payment and billing information is required to purchase a paid subscription
- certain tax or billing information may be required where necessary to comply with tax or accounting obligations.

If you do not provide information required for account creation, authentication, payment processing or performance of a subscription contract, we may be unable to provide the relevant service.Providing information through our contact form is voluntary. However, we require sufficient information to understand and respond to your enquiry.This information is provided in accordance with Article 13(2)(e) GDPR.

6. Website Hosting and Webflow

Varhor is built and hosted using services provided by:
‍Webflow, Inc.
398 11th Street, Floor 2
San Francisco, CA 94103
USA
When you access varhor.com, Webflow may process technical information necessary to deliver and operate the website.
This may include:
- IP address
- browser and device information
- operating system
- date and time of access
- requested pages or resources
- referring URL
- technical and security information.

The purposes include delivering the website, maintaining availability and security, preventing misuse and enabling technical operation.The legal basis is Article 6(1)(f) GDPR and, where the processing is necessary to provide contractual Varhor services, Article 6(1)(b) GDPR.For personal data processed by Webflow on behalf of Varhor in relation to website visitors and form submissions, Webflow generally acts as a processor. Webflow states that Customer End User information is processed in accordance with the customer's instructions. Webflow stores Customer and Customer End User data in the United States and uses international transfer safeguards including the EU-U.S. Data Privacy Framework and, where applicable, the European Commission's Standard Contractual Clauses. Further information is available in Webflow's Privacy Policy and Data Processing Addendum.

7. Contact Form and Communications

If you contact Varhor through our contact form, we may process:
- your name;your email address
- your message
- other information voluntarily included in your enquiry
- technical information associated with the submission.

We use this information to receive, process and respond to your enquiry.Where your communication concerns an existing contract or steps requested before entering into a contract, processing is based on Article 6(1)(b) GDPR.For other enquiries, processing is based on our legitimate interest in responding to communications and operating our business pursuant to Article 6(1)(f) GDPR.Where our contact form is configured to send submissions to Webflow, Webflow stores the submitted information in the Webflow site account and may send corresponding form notifications. Webflow confirms that form submissions sent to Webflow are stored in the site's form settings. Webflow may also use technical security, spam-filtering or bot-prevention measures and subprocessors as part of its form and hosting services.Contact enquiries are retained only for as long as necessary to process the request, unless further retention is required for contractual documentation, statutory obligations or the establishment, exercise or defence of legal claims.

8. Cancellation and Withdrawal Forms

‍On our cancellation and withdrawal pages we collect the information required to identify you and your contract, in particular your name, postal address, the email address used for your subscription, the date of your order, the email address for our confirmation and, where applicable, your reason for terminating for good cause. We also record the date and time your declaration reaches us.We process this information to identify your contract, to send you the confirmation required by Sections 312k and 356a of the German Civil Code, to give effect to your declaration and to document the transaction. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(c) GDPR.Submissions from these forms are transmitted to Make, operated by Celonis SE, Theresienstraße 6, 80333 Munich, Germany, which we use to receive form submissions and to send the corresponding confirmations. Confirmations are sent using Microsoft 365 services provided by Microsoft Ireland Operations Limited. A data processing agreement pursuant to Article 28 GDPR is in place with each provider.

9. Member Accounts and Memberstack

Varhor uses:
‍Memberstack, Inc.
1209 Orange Street
Wilmington, New Castle County
Delaware 19801
USA

Memberstack provides account creation, authentication, membership management, access control and other member-area functionality.When you create or use a Varhor account, the following information may be processed through Memberstack:
- name
- email address
- authentication information
- membership status
- subscription and plan information
- account information
- custom account fields, where applicable
- technical and security information.

The processing is necessary to create and administer your Varhor account and to provide access to the member services you request.The legal basis is Article 6(1)(b) GDPR.Memberstack processes client personal data under its Data Processing Addendum. Memberstack states that its services are hosted using Amazon Web Services and that its current data storage location is the United States. For transfers of personal data outside the EEA, Memberstack's DPA incorporates the European Commission's Standard Contractual Clauses where required. Further information is available in Memberstack's Privacy Policy and Data Processing Addendum.

10. Authentication and Local Storage

Memberstack uses browser local storage by default to maintain authentication sessions and allow users to remain logged in when navigating or refreshing the website. Where storage of or access to information on a user's device is strictly necessary to provide a digital service expressly requested by the user, prior consent is not required under Section 25(2) no. 2 TDDDG.Section 25 TDDDG otherwise generally requires consent for storing information on or accessing information from a user's device, subject to statutory exceptions.
We use necessary authentication technologies for purposes such as:
- logging users into their accounts
- maintaining authenticated sessions
- controlling access to member-only content
- protecting accounts against unauthorised access.

Such necessary technologies are not used by Varhor for advertising purposes.

11. Payments and Subscriptions – Stripe

Varhor uses Stripe to process payments, recurring subscriptions and related billing functions.Depending on the processing activity, relevant Stripe entities may include Stripe Payments Europe, Limited, Stripe Technology Company, Limited, and other Stripe affiliates.Stripe states that Stripe Payments Europe, Limited is the contracting entity under the DPA for users outside the Americas, while Stripe entities may have different roles depending on the specific payment or processing activity. When you purchase or manage a Varhor subscription, Stripe may process information including:
- name
- email address
- billing address
- payment method information
- transaction amount
- currency
- subscription status
- payment history
- tax information and tax identification number where applicable
- IP address and device information
- information used for payment authentication, security and fraud prevention.

Payment information entered through the Memberstack/Stripe payment process is transmitted directly to Stripe. Memberstack states that it does not store credit card data on its servers and that card payment data is sent directly to Stripe. Processing necessary to purchase and administer your Varhor subscription is based on Article 6(1)(b) GDPR.Processing required for statutory tax, invoicing and accounting obligations is based on Article 6(1)(c) GDPR.Security and fraud-prevention activities for which Varhor determines the purposes may be based on Article 6(1)(f) GDPR.Stripe may act either as a processor on behalf of Varhor or as an independent controller depending on the specific processing operation. Stripe identifies, among other things, fraud detection, financial-risk prevention, compliance with legal obligations and certain internal operations as activities for which Stripe may act as controller. Further information is available in Stripe's Privacy Policy and Privacy Center.

12. Billing Address, Tax Information and Stripe Tax

Where applicable, Varhor may use Stripe functionality to collect:
- billing addresses
- country information
- VAT or other tax identification numbers
- information required to determine the applicable tax treatment.

This information may be processed for purposes including:determining applicable taxes;validating tax information;issuing invoices;maintaining payment records;meeting statutory accounting and tax obligations.The legal bases are Article 6(1)(b) GDPR where the information is necessary for the subscription contract and Article 6(1)(c) GDPR where processing is required by law.

13. Necessary Cookies, Local Storage and Similar Technologies

Varhor currently does not intentionally use non-essential analytics or advertising technologies such as:
- Google Analytics
- Meta Pixel
- Microsoft Clarity
- Google Ads conversion tracking
- comparable behavioural advertising trackers.

However, Varhor and the service providers required to operate the website may use cookies, local storage or similar technologies where necessary for:
- website operation
- authentication
account access
session management
security
- fraud prevention
- payment processing
- technically necessary preferences.

Where such storage or access is strictly necessary to provide a digital service expressly requested by the user, it may be used without consent in accordance with Section 25(2) no. 2 TDDDG. If Varhor introduces consent-dependent analytics, advertising, personalisation or comparable technologies in the future, we will implement an appropriate consent mechanism before activating them where legally required and update this Privacy Policy accordingly.

- Make (Celonis SE) for receiving form submissions and sending automated confirmations
- Microsoft Ireland Operations Limited for email hosting and the sending of contractual confirmations

14. Recipients of Personal Data

We disclose personal data only where this is necessary for the purposes described in this Privacy Policy or otherwise permitted or required by law.Recipients or categories of recipients may include:
- Webflow and its subprocessors for website hosting, security and forms
- Memberstack and its subprocessors for account and membership management
- Stripe and relevant Stripe affiliates and service providers for payments, billing, tax processing and fraud prevention
- email and communication service providers used to receive and respond to communications
- accountants, tax advisers, lawyers and other professional advisers where necessary
- courts, tax authorities, regulators or other public authorities where disclosure is legally required.

We do not sell personal data of Varhor users.

15. International Data Transfers

Some service providers used by Varhor are located outside the European Economic Area or use subprocessors located in third countries.In particular, Webflow and Memberstack process certain data in the United States.Webflow states that it is certified under the EU-U.S. Data Privacy Framework and additionally incorporates the EU Standard Contractual Clauses into its Data Processing Addendum for relevant transfers. Memberstack states that data is currently stored in the United States and that its Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses for relevant transfers. Stripe uses international transfer mechanisms including the EU-U.S. Data Privacy Framework and European Commission Standard Contractual Clauses where applicable. Where required by Articles 44 et seq. GDPR, we use or rely upon an appropriate transfer mechanism to protect personal data transferred outside the EEA.Information regarding applicable safeguards may be requested from us using the contact details set out above, subject to applicable confidentiality restrictions.

Cancellation and withdrawal declarations
‍Declarations of cancellation and withdrawal, the confirmations we send and the associated timestamps are retained for the statutory limitation and retention periods, as they document the performance of the contract.

16. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected unless a longer period is required or permitted by law.

Account and membership information
Account information is generally retained for the duration of the account and contractual relationship.Following termination or deletion of the account, information will be deleted or anonymised when it is no longer required, subject to statutory retention obligations and legitimate requirements relating to legal claims.

Contact enquiries
Contact information and correspondence are retained for as long as required to process the relevant enquiry and thereafter only where continued retention is necessary for contractual documentation, statutory requirements or legal claims.
‍
Payment, invoicing and accounting information.
Information forming part of documents subject to statutory accounting or tax retention obligations is retained for the applicable statutory period.Under current German law, invoices must generally be retained for eight years. Certain accounting vouchers are generally subject to an eight-year retention period, certain books and financial records to ten years and certain business correspondence to six years. Only the information required for the relevant statutory purpose is retained for such periods.

17. Your Data Protection Rights

Subject to the applicable statutory requirements, you have the following rights:
- Right of access – Article 15 GDPR
- Right to rectification – Article 16 GDPR
- Right to erasure – Article 17 GDPR
- Right to restriction of processing – Article 18 GDPR
- Right to data portability – Article 20 GDPR
- Right to object – Article 21 GDPR
- Right to withdraw consent – Article 7(3) GDPR.

To exercise your rights, contact:
info@varhor.com

‍We may request information reasonably necessary to verify your identity before responding to a request.The existence of these rights and the requirement to inform data subjects about them form part of the transparency obligations under Article 13 GDPR.

18. Right to Object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.If you object, we will cease the relevant processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.If personal data is ever processed for direct marketing purposes, you have the right to object to such processing at any time.

19. Withdrawal of Consent

Where processing is based on your consent under Article 6(1)(a) GDPR, you may withdraw that consent at any time with effect for the future.Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.

20. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
As Varhor is based in Nordrhein-Westfalen, the competent supervisory authority is generally:
‍The Hessian Commissioner for Data Protection and Freedom of Information
(Der Hessische Beauftragte für Datenschutz und Informationsfreiheit – HBDI)
‍Wilhelmstraße 7
65185 Wiesbaden
Germany

The HBDI has been located at Wilhelmstraße 7 since 16 March 2026. You may also have the right to contact another competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

21. Automated Decision-Making

Varhor itself does not currently make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.Stripe may independently use automated systems for purposes including payment security, fraud detection and risk prevention. Where Stripe independently determines the purposes and means of such processing, Stripe acts in accordance with its own data protection responsibilities. Further information is available from Stripe.

22. Data Security

We take appropriate technical and organisational measures designed to protect personal data against:
- unauthorised access
- unlawful processing
- accidental loss
- destruction
- alteration
- unauthorised disclosure.

We also use service providers that maintain technical and organisational security measures.Memberstack states that data transmitted between websites and its servers is protected using HTTPS and that data stored in its database is encrypted at rest. Webflow states that it encrypts data in transit and at rest and maintains security controls for its infrastructure. Nevertheless, no internet-based service can guarantee absolute security.

23. Third-Party Links

Varhor may contain links to websites or services operated independently by third parties.Once you access an external website, the processing of personal data by that provider is governed by its own privacy practices.Varhor does not determine how independent third-party websites process personal data.

24. Users Outside the European Economic Area

Varhor is available internationally.Where data protection laws outside the EEA apply to the processing of your personal data, you may have additional rights under the laws applicable to you.Varhor will comply with mandatory data protection requirements applicable to its processing activities where required by law.

25. Changes to this Privacy Policy

We may update this Privacy Policy where necessary, including where:our services change;we introduce or remove service providers;our processing activities change;new technologies are implemented;applicable legal requirements change.The current version will be made available on varhor.com and will contain the applicable “Last updated” date.Where required by law, we will provide additional notice of material changes.

26. Contact

For questions about this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, please contact:
‍Varhor – Real Estate Market Intelligence
Diana Bagdasaryan
Bismarckstraße 19 A
32756 Detmold‍
Germany

Email: info@varhor.com