Privacy policy

This privacy policy explains which personal data we process when you use vermietfabrik.de, why we do so, how long we keep it and which rights you have. It applies to the website, the customer account, rental applications and all related communication.

1. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

OSKOREAL Service GmbH (operator of Vermietfabrik)

• Langenfelder Straße 71a, 22769 Hamburg, Germany
• Commercial register: Amtsgericht Hamburg, HRB 137816
• Email: info@vermietfabrik.de

For all questions about data protection and to exercise your rights, please write to info@vermietfabrik.de with the subject "Data protection". Further company details are in the legal notice.

2. Overview

We process personal data only where a legal basis allows it. Depending on how you use our services, this includes:

• Technical access data whenever you open a page (for example IP address, date and time, browser).
• Account data if you register (name, email address, password, telephone number, preferred language).
• Application data if you apply for a property (contact and address details, dates, your message).
• Payment and document data once an application is approved (invoice, payment confirmation, rental documents).
• Enquiry data if you contact us.
• Usage statistics only if you have agreed to analytics cookies.

We do not sell personal data and do not use it for advertising profiles.

3. Visiting the website

When you open our website, the servers of our hosting provider automatically process the data your browser transmits: IP address, date and time of the request, the page requested, the referring page, browser type and version, operating system and the amount of data transferred. This is technically necessary to deliver the website and to protect it against attacks and misuse.

To show the website in a suitable language, we determine the country from the IP address of the request using an offline database on our own server. The IP address is not stored for this purpose; only the chosen language is remembered in a cookie.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and working website). Server logs of the hosting provider are deleted after a short period, usually within 30 days, unless an incident has to be investigated.

4. Customer account

To apply for a property you need a customer account. We process your name, email address, telephone number (optional), your password (stored only as a secure hash, never in plain text), your preferred language and, once you provide them, your address and country. We confirm your email address with a verification link. While you are logged in, a session cookie keeps you signed in (see the cookie policy).

Legal basis: Art. 6(1)(b) GDPR (contract and pre-contractual steps). We keep your account until you ask us to delete it. You can request deletion at any time by email; data we must keep by law is then restricted and deleted when the retention period ends (see section 12).

5. Rental applications

When you apply for a property, we process your full name, email address, telephone number, residential address, city, postal code, country, your preferred move-in date, the inspection appointment you selected, your optional message, the date on which you accepted our terms, the financial terms of the property (rent, deposit, total amount due) and the progress of your application.

We use this data to review your application, to arrange viewings, to communicate with you and, if the application is approved, to prepare the tenancy. Where this is required to conclude the tenancy, we pass the necessary application details to the owner of the property. All decisions on applications are made by our staff; there is no automated decision-making within the meaning of Art. 22 GDPR.

Legal basis: Art. 6(1)(b) GDPR. Please only provide the information we ask for. Do not send us special categories of personal data (for example health data) unless we explicitly request them.

6. Payment, invoices and rental documents

After approval we issue an invoice with the bank details for the transfer. You can upload a confirmation of your transfer (image or PDF) in your customer account. Payment confirmations and signed documents are stored in a private storage area and can only be opened through short-lived, signed links by you and by authorised staff. We create and store the documents belonging to your application, such as the viewing permit, invoice, rental agreement and payment confirmation record. Documents carry a verification code so that their authenticity can be checked.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR in conjunction with the retention duties of German commercial and tax law (§ 257 HGB, § 147 AO).

7. Contact and enquiries

If you contact us through the contact form, by email or by telephone, we process your name, email address, telephone number if provided, the topic, the property or application concerned, your message, the language you wrote in and our reply, in order to answer your enquiry.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a rental or a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). Enquiries are deleted when they are no longer needed, at the latest three years after the end of the year in which the matter was closed, unless statutory retention duties apply.

8. Emails we send

We send transactional emails that are necessary for your account and applications, for example email verification, password reset, confirmation of receipt, decisions on your application, payment instructions and reminders, and notifications about new documents. We keep a technical log of sent emails (recipient, subject, time, delivery status) for 180 days to be able to prove delivery and to solve delivery problems. We do not send newsletters or advertising emails.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the delivery log.

9. Usage statistics (only with your consent)

If you allow analytics in the cookie banner, we use two statistics tools:

• Our own visit statistics. A first-party cookie (_fsid, valid for 30 minutes) groups the pages you view during one visit. We record the pages and properties viewed, searches, favourites, the start of an application, device type, browser, operating system, the country and city derived from your IP address, the referring website and campaign parameters. When you are logged in, the visit is linked to your account. We use this to understand which properties and pages are helpful and to calculate an interest score that helps our team prioritise enquiries. The score has no influence on the decision about your application. Event data is deleted after 180 days.
• Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how the website is used. IP addresses are shortened, and we have not activated advertising features. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Event data is kept for a maximum of 14 months.

Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future using the "Cookie settings" link in the footer of every page. Until you give your consent, neither tool is active.

10. Service providers and recipients

We use carefully selected service providers who process data on our behalf and are bound by data processing agreements (Art. 28 GDPR):

Our fonts are hosted on our own servers; no connection to Google Fonts is made. Beyond this, we pass data on only where this is necessary for the tenancy (the property owner, see section 5), where we are legally obliged to do so (for example to authorities), or where it is required to establish or defend legal claims (for example to lawyers).

11. Transfers outside the EU

Some providers are located outside the European Economic Area or may access data from there. We only allow such transfers if an adequacy decision of the European Commission exists (for example the EU-U.S. Data Privacy Framework for certified US companies) or if appropriate safeguards are in place, in particular the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards from us.

12. How long we keep data

If data is needed to establish, exercise or defend legal claims, we may keep it until the applicable limitation period has ended (generally three years).

13. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability in a structured, commonly used format (Art. 20),
• object to processing based on our legitimate interests (Art. 21),
• withdraw your consent at any time with effect for the future (Art. 7(3)).

To exercise your rights, simply write to info@vermietfabrik.de. We may ask you to confirm your identity.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

14. Security

All connections to our website are encrypted (TLS). Passwords are stored as salted hashes, access to the administration area is restricted to authorised staff, and sensitive documents are kept in private storage that can only be opened with short-lived signed links. No system is completely secure, however; please keep your password confidential and tell us immediately if you suspect misuse of your account.

15. Minors

Our services are intended for adults. We do not knowingly process data of persons under 18.

16. Changes to this policy

We update this privacy policy when our services or the legal requirements change. The current version is always available on this page; the date of the last revision is shown below.