Privacy Policy

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Mark Pleschka
c/o IP-Management #10898
Ludwig-Erhard-Str. 18
20459 Hamburg
Email: datenschutz@findemieter.de

When you access our website, your browser automatically transmits information to the server, where it is temporarily stored in what are known as log files: IP address, the date and time of the request, the resource requested, the previously visited page (referrer), and your browser type and operating system. This processing is technically necessary in order to deliver the website, ensure its stability and security, and prevent abuse (such as automated attacks). The website is delivered via our service provider Cloudflare (see Section 12).

To limit the frequency of requests (rate limiting), we briefly store the IP address as a counter value for individual features that are accessible even without logging in. These entries are automatically deleted after no more than two days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable, and abuse-free operation).

To use the platform, you create a user account. In doing so, we process your email address, a password chosen by you (which is stored exclusively in encrypted form as a hash, never in plain text), the role you selected (tenant or landlord), your language preference, and a display name.

To confirm your registration, reset your password, and send security-relevant account notifications, we send system emails via our email service provider (see Section 12).

Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

Tenants can create a search profile. Depending on the details you provide, we process: household size, income bracket (as a rough range, not an exact amount), information about pets, whether you are looking for a flat-share, whether you hold a housing entitlement certificate (Wohnberechtigungsschein, WBS), the earliest and latest move-in date, a free-text self-description, further preferences, and the amenities you are looking for.

Your search profile also includes your search locations: cities, districts, a search radius, and the associated geographic coordinates. You may optionally upload a profile picture. Landlords, too, can provide a display name and a profile picture. Images are stored on our behalf by Supabase (see Section 12) and are deleted when you remove the image or delete your account.

These details are visible in search to logged-in landlords (and administrators) so that a match can be made. Your email address is never shown to other users at any time.

Legal basis: Art. 6(1)(b) GDPR (provision of the matching service).

Contact is initiated through the platform. We do not pass direct contact details (such as email addresses) between users. Whether users additionally choose to share contact details voluntarily and communicate outside the platform is their own responsibility. When a landlord sends a contact request, we process the message as well as a snapshot of the key apartment details (city/district, apartment type, floor area, number of rooms, year of construction, amenities, but without street and house number). Once the request has been accepted, both sides can exchange messages.

Message content is stored in encrypted form (see Section 14). We notify you of new messages and requests by email (see Section 12).

Legal basis: Art. 6(1)(b) GDPR.

Users can report other accounts, for example where fraud is suspected. In doing so, we process the report itself, in particular the stated reason and the accounts involved. We do not separately copy or store the content of the conversation concerned. It remains subject to automatic deletion after 90 days (see Section 11). For the prevention of abuse and fraud, a report is retained even if the reported or the reporting account is deleted in the meantime. The reference to the deleted account is removed in that case.

Where there is reasonable suspicion, we may block accounts. The person concerned is notified of this by email.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an abuse-free and fraud-free platform).

If you contact us via the “Report a problem” feature or by email, we process the information you provide (your message, your email address, and where applicable the page from which the request originated) in order to handle your request. These messages are forwarded to our support mailbox (see Section 12).

Legal basis: Art. 6(1)(b) and (f) GDPR (handling your request).

To improve and stabilize our service, we measure reach without cookies. We use Cloudflare Web Analytics: a privacy-friendly, cookieless measurement without persistent identifiers that records aggregated metrics such as page views, referral sources, rough geographic region, and load times.

In addition, we record aggregated product events (such as “search performed”) using Cloudflare Analytics Engine. Any user or IP identifier is irreversibly shortened to a hash value before storage, so that no plain-text link to a person is created. No cookies are set and no personal usage profiles are created.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a needs-based, stable website).

During registration and in your profile settings, you can optionally consent to receive marketing emails from us. We distinguish two categories: reminders and updates about your search along with news and tips from findemieter.de, and offers from partner companies. Both are strictly opt-in (disabled by default).

We store your email address, a pseudonymous unsubscribe token, and the time of your consent. You can switch each individual category on and off at any time in your profile, or withdraw your consent entirely via the unsubscribe link in every email. A withdrawal takes effect immediately.

Consents you give during registration only take effect after you click the confirmation link (double opt-in). We automatically delete unconfirmed entries after 30 days. After a withdrawal, we retain the entry for a further twelve months for documentation purposes (Art. 5(2) GDPR) and then likewise delete it automatically.

If you delete your account, we automatically withdraw every marketing consent you gave and replace your email address in our marketing data with a placeholder. The entry itself is retained for documentation purposes as described in paragraph 3; you will not receive any further marketing emails.

Legal basis: Art. 6(1)(a) GDPR (consent). Retention for documentation purposes is based on Art. 6(1)(f) GDPR.

When you delete your account or deactivate your search profile, we ask you on a voluntary basis for a reason (a selectable category and/or free text). Both fields are optional. If you provide nothing, nothing is stored. We store your answers anonymously: without a user ID, without an email address, and only with a date to the day: the selectable category additionally with your role (tenant or landlord), the free text without any further details. Subsequent attribution to your account is not possible. Please therefore do not enter any personal data in the free-text field.

We follow the principle of data minimization (Art. 5(1)(e) GDPR):

• Chats: Conversations between landlords and tenants are automatically deleted 90 days after the last message. A new message resets the period. Contact requests that go unanswered are likewise deleted 90 days after they are created. If you delete your account, the 28-day ceiling under “Account data” applies before that period ends.
• Inactive search profiles: If an account is not used for 56 days, we automatically deactivate the search profile (announced by email seven days beforehand). It then no longer appears in search. You can reactivate it at any time by logging in again.
• Abuse reports: If a user reports another account, we store the report itself (the stated reason and the accounts involved) for the prevention of abuse and fraud. We do not copy the content of the conversation concerned. It remains subject to automatic deletion after 90 days. A report is retained even if the reported or the reporting account is deleted in the meantime. The reference to the deleted account is removed in that case (legal basis: Art. 6(1)(f) GDPR).
• Account data: is retained until you delete your account. On deletion, personal data is removed. Existing chat histories with other users are anonymized (display name: “Deleted user account”) and your account is fully removed no later than 28 days after deletion. Abuse reports are exempt from this (see above): the report itself may be retained beyond that point for fraud prevention.

We do not pass personal data on to third parties for our own purposes. To provide the platform, however, we use carefully selected service providers that process data exclusively on our behalf and on our instructions (processing on behalf of the controller under Art. 28 GDPR):

• Supabase: Database, account management, file storage (profile pictures), and real-time features. Storage takes place in the EU (Frankfurt region).
• Brevo: Sending our emails, including notifications, system and account emails, and, subject to consent, marketing emails.
• Cloudflare: Hosting, delivery of the website (CDN), protection against attacks, cookieless audience measurement, and forwarding of incoming email.
• komoot (Photon) and OpenStreetMap/Overpass: Conversion of location input into geographic data (geocoding). We make these queries server-side. Your IP address is not transmitted to these services. Only the search term you entered or coordinates are transmitted.
• Proton: Mailbox for incoming email to our contact, support, and data protection addresses.

We have data processing agreements in place with these service providers. Where processing takes place outside the EU or the EEA, it is safeguarded by appropriate guarantees (such as EU Standard Contractual Clauses). Any disclosure beyond this only takes place where we are legally obliged to do so.

Legal basis: Art. 6(1)(b) and (f) GDPR.

We use only technically necessary cookies, in particular for logging in (authentication). The language preference is controlled via the page address (for example /de, /en) and does not require its own cookie. Beyond that, we temporarily store individual inputs (such as a draft profile or the state of a search) in your browser's session storage. This data is deleted when you close the browser tab and is not transmitted to us. We do not use tracking or advertising cookies. A consent banner is therefore not required.

Legal basis: § 25(2) TDDDG (technically necessary storage) in conjunction with Art. 6(1)(f) GDPR.

We take technical and organizational measures to protect your data. These include encryption of data transmission (HTTPS), an additional, application-side encryption of chat content, strict separation of access at the database level (everyone sees only their own data), the exclusively encrypted storage of passwords, and measures against automated attacks (rate limiting).

Within the scope of the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20), as well as the right to object to processing (Art. 21). You can withdraw consent you have given (for example for marketing emails) at any time with effect for the future.

You can delete your account yourself at any time. In doing so, your personal data is removed (see Section 11). For matters relating to data protection, you can reach us at datenschutz@findemieter.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the supervisory authority of your habitual place of residence or the authority responsible for us:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Email: mailbox@datenschutz-berlin.de
Phone: +49 30 13889-0

On the platform (for example in the moving checklist) and, with your consent, in marketing emails, we may recommend offers from partner companies and use so-called affiliate links for this. If you take up an offer linked in this way, we may receive a commission from the respective partner company. We label affiliate links as advertising.

When you click an affiliate link, you leave our platform. We do not transmit any personal data to the partner company in the process, and no cookies are set on our site for this purpose. The respective partner company is responsible for the data processing on the linked pages (including any cookies used there). Their privacy information applies.

To evaluate the use of our recommendations, we count clicks on affiliate links in our own systems. We store the offer that was clicked, the place the click came from (for example, which email), and the time. Your IP address is irreversibly shortened to a hash value beforehand, so that no plain-text link to a person is created. For protection against automated access, Section 02 additionally applies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in financing our free service and in evaluating our recommendations).

We will adapt this privacy policy if the legal situation or our service changes. The current version published here applies in each case.